BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Group-IB details BraZetsu, a modular Python Windows malware that monetizes compromised-host access through the Infected Marketplace for initial access brokers.
Group-IB attributes BraZetsu to the Exilware threat actor, believed to be native Portuguese speakers targeting Iberian and Latin American e-commerce, financial, industrial, and law enforcement victims. The framework, first observed in early May 2026, uses generative AI for data triage and target prioritization, steals browser histories and digital certificates, and hunts Brazilian CNAB financial remittance files. Access to compromised hosts is sold on the Infected Marketplace from roughly $5.80, letting buyers remotely deploy secondary payloads over WebSocket-linked infrastructure. Some samples evaded detection on VirusTotal; delivery likely uses VBS loaders from a domain also used to distribute the Ousaban banking trojan.
- Modular Python toolkit supports reconnaissance, remote shell execution, and worker module deployment
- Uses generative AI for backend data triage and high-value target prioritization
- Targets CNAB financial remittance files used for Brazil bank-corporate transactions
- Overlaps with CNABHunter, which rewrites CNAB payment files with attacker-controlled PIX keys
- Access sold on Infected Marketplace with an initial deposit around $5.80
- Products
- BraZetsuCNABHunter
- Threat actors
- Exilware
- Malware
- BraZetsuCNABHunterOusaban
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | caixaentradas1inboxshop.site | ft Edge and is downloaded from a distribution domain named "caixaentradas1inboxshop[.]site." An analysis of the files associated with the domain has |
| domain | infect.online | tion for the Infected Marketplace (aka "Banco de Infects," "infect[.]online"), a platform where the threat actor monetizes initial ac |
| ipv4 | 38.242.246.176 | ention used by Exilware has also identified an IP address ("38.242.246[.]176") that has been previously tied to AgenteV2 , a Python-ba |
From the original article
7 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a sophisticated Python-based Windows malware framework called BraZetsu that fuels an underground marketplace commercializing access to compromised hosts. "Unlike the standard infostealer model, BraZetsu is a comprehensive master toolkit that empowers Initial Access Brokers (IABs) by turning compromised systems into highly valuable commercial
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.