Thankfully modern browsers use Certificate Transparency, and there’s no indication that any compromised certs were actually used publicly.
However, there are many devices that use TLS which are not browsers, and those devices could in theory be selectively targeted with an evil cert without alerting the public CT servers.
Does this mean no one tried a sequential brute force attack on these systems?
Someone probably did. They probably didn’t share that.
Thankfully modern browsers use Certificate Transparency, and there’s no indication that any compromised certs were actually used publicly.
However, there are many devices that use TLS which are not browsers, and those devices could in theory be selectively targeted with an evil cert without alerting the public CT servers.
It means that some people are trying that – now.
That’s likely how they were found by the original reporter