BraZetsu C2 and panel IP sweep (38.242.246.176, 80.78.27.252)
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Microsoft Sentinel (KQL)

