Brutus has grown from a focused credential-testing tool into a full enumeration-and-access engine. Since the last update it reaches more identity sources, tests credentials across many more protocols, reuses confirmed credentials automatically across a customer's environment, and detects pre-authentication RDP backdoors — all from a Nerva pipeline, without manual intervention.

What's New

Broader account and people enumeration

• HUMINT people enumeration — a new subsystem maps organizational exposure through professional-identity data, including an Apollo.io connector with a split discover/enrich flow that avoids auto-revealing the full org roster.

• Microsoft 365, first-class — brutus enum active microsoft365 is now its own subcommand (previously reachable only inside enum active oracles), with rotating-proxy support.

• LinkedIn Sales Navigator — a new connector for personnel discovery.

• Reliable GitHub email enumeration — enumeration through rotating proxies no longer stalls or fails silently: the CSRF session handshake is fixed and progress is now surfaced during session establishment.

• Named results — generated usernames now carry the first and last name that produced each candidate, so downstream consumers no longer have to reverse-derive names from local parts.

• Proxy support across enumeration modes — rotating-proxy support is now available throughout active enumeration.

More protocols under credential testing

• Fourteen new protocol plugins — Brutus now tests credentials and detects unauthenticated access across AMQP, MQTT, Kafka, Memcached, SOCKS5, Firebird, XMPP, NATS, ZooKeeper, ActiveMQ, DB2, OPC UA, SIP, and IPMI — broadening coverage across messaging, database, industrial (OPC UA), and out-of-band management (IPMI, tested for default BMC credentials) interfaces. Services fingerprinted by Nerva on any port are testable without manual setup.

• TLS for PostgreSQL — the PostgreSQL plugin now honors Brutus's TLS mode configuration, so TLS-only servers are reachable, bringing it in line with the MySQL, MSSQL, Neo4j, and LDAP plugins.

• Hardened PostgreSQL connector — credentials containing special characters, spaces, or IPv6 hosts are now handled correctly, eliminating connection failures that previously caused silently missed checks.

Credential intelligence that compounds

• Confirmed credentials handed to CATO — credentials Brutus confirms during a hunt are now persisted and made available to CATO for its re-verification pass, instead of being lost when the task container exits.

• Cumulative per-tenant credential corpus — a confirmed credential pair is stored per tenant and automatically tested against other services in future runs, exploiting password reuse across a customer's environment without manual intervention.

New: RDP logon-screen backdoor detection

• Sticky Keys and Utilman backdoors — Brutus detects accessibility-tool backdoors (sethc.exe / Utilman replaced with a SYSTEM shell) that survive credential rotation and sit at the RDP logon screen. Detection is pre-authentication and requires no credentials: it captures baseline and response screenshots over a non-NLA RDP connection, sends the known trigger, and compares — without modifying system state — on in-scope assets under active testing posture.