BraZetsu: The Brazilian Malware Turning Every PC into a Dark Web Product

The BraZetsu malware framework, attributed with high confidence to the Brazilian threat actor Exilware, is redefining the cybercrime business model in Latin America. On September 3, 2026, Group-IB researchers published a technical analysis documenting five distinct versions of the toolkit. Its operational core transforms compromised Windows systems into commercial assets sold on an underground marketplace called the "Infected Marketplace." The novelty is not the technique but the economy: initial access becomes a service, buyers execute payloads remotely, and artificial intelligence handles triage and pricing.

From Infostealer to Marketplace: BraZetsu's Commercial Architecture

Group-IB malware analysts Julio Guapo Menezes and Miguel Salazar drew a sharp distinction in the report: "Unlike the standard infostealer model, BraZetsu is a comprehensive master toolkit that empowers Initial Access Brokers (IABs) by turning compromised systems into highly valuable commercial assets." The operational difference is substantial. A traditional infostealer extracts credentials and sells them in bulk; BraZetsu maintains persistent access, catalogs the machine as inventory, and lets the buyer use it as a launch platform.

The technical architecture reflects this commercial maturity. The framework is written in Python and compiled with Nuitka, a transpiler that generates native executables, complicating reverse engineering. Command-and-control communication occurs via the WebSocket protocol, ensuring persistent, bidirectional channels compared to classic HTTP polling. Some analyzed samples were completely undetectable — the Group-IB report includes a VirusTotal screenshot showing zero detections — at the time of analysis.

Data collection is extensive and commerce-oriented. BraZetsu enumerates installed applications, active processes, network services, browser profiles, open windows, recent files, hardware metadata, and security tool presence. It compares URLs extracted from Chrome, Edge, Brave, Vivaldi, and Opera history against a list of roughly 230 target domains and paths to profile victim behavior. It specifically searches for CNAB remittance files, the Brazilian banking format, and digital certificates with .pfx and .p12 extensions. This granularity serves not the sale of isolated credentials but the market-price estimation of the access itself.

Generative AI in the Criminal Workflow: Development and Triage

AI integration distinguishes BraZetsu from previous regional toolkits. Group-IB documents "heavy reliance on generative AI, not only for development but potentially also for backend data triage." The first component is verified: development artifacts and verbose Portuguese logging, with extensive emoji use in status messages, suggest generative models assisted code and internal documentation authoring. The second component — automation of collected-data triage and target prioritization — is flagged as probable but unconfirmed at the backend infrastructure level.

The source does not specify which generative model is employed or where processing servers reside. It is documented, however, that "The malware's AI-driven assessment capabilities automatically evaluate compromised machines' commercial potential through hardware profiling, software environment analysis, and network infrastructure mapping." This automated assessment determines whether a host merits immediate cataloging in the marketplace or is discarded as low-value.

The "Access-as-a-Service" Model and the Threat Multiplier

"By functioning as a service-enabled platform, the marketplace allows criminal customers to remotely execute secondary malicious payloads on purchased access, creating a persistent threat-multiplier effect across the regional ecosystem" — Group-IB

The Infected Marketplace's commercial structure, also known as "Banco de Infects" and reachable at the domain infect[.]online, lowers the barrier to entry for threat actors lacking their own initial-access capabilities. The initial deposit of approximately $5.80, reported by The Hacker News citing the Group-IB report, positions the service in a price tier accessible even to minor operators. The buyer does not receive static credentials; they obtain an interface for remote payload execution on already-compromised hosts, with persistence managed by the seller.

This role separation — who compromises, who commercializes, who exploits — replicates models already consolidated in Anglosphere ransomware within Latin American criminal markets. The Brazil-specific element is integration with local financial infrastructure. The search for CNAB files and digital certificates indicates Exilware maintains operational ties to the national banking malware tradition even while expanding toward international corporate targets. The domain caixaentradas1inboxshop[.]site, used to distribute BraZetsu, was previously employed for the Ousaban banking trojan, documenting infrastructural overlap with established malware families.

Evolutionary Timeline and Convergence with AgenteV2

The first BraZetsu iteration is dated February 9, 2026. The first observation of the framework with documented characteristics dates to May 2, 2026. Between these dates and the report's publication, five distinct versions emerged, with a clear evolutionary trajectory: the third generation eliminated generalist targeting to focus exclusively on Brazilian corporate organizations. This narrowing suggests commercial feedback — buyers demanded higher-value access — guided development.

Convergence with AgenteV2 was established by Group-IB with high confidence through four anchors: shared codebase, identical tradecraft, overlapping infrastructure — including IP address 38.242.246.176 previously associated with AgenteV2 — and parity of functional capabilities. This identification places BraZetsu in a line of operational continuity rather than as a greenfield project, with implications for profiling the Exilware threat actor.

The relationship with CNABHunter, another Brazilian malware specialized in hunting banking files, is instead limited. Group-IB verifies that "the only notable code overlap between the two artifacts is the directory list used to locate CNAB-related files." Architectures, workflows, objectives, C2 servers, and communication protocols differ. The "connection remains unknown," with the only plausible link being shared profit opportunity in targeting the Brazilian financial sector.

Why It Matters

The Group-IB dossier does not specify the initial infection vector with certainty. The source indicates social engineering as "the most likely culprit" without confirming the delivery modality. This gap prevents defining targeted technical countermeasures for entry prevention.

The brief does not document specific remedial measures released by vendors or authorities. No indication emerges of patches, detection rules, or hardening actions approved by the primary source. Group-IB does not quantify the total number of victims, buyers, or completed marketplace transactions, limiting estimation of the threat's true scope.

Documented geographic extension concentrates on Latin America and Iberia, with sporadic observation of compromised systems in the United States starting April 2026. The brief does not specify whether these represent deliberate Exilware expansion or buyers who resold access to operators with different interests.

The actual degree of AI automation in the marketplace backend remains unverified. The source uses "potentially" to qualify AI-assisted data triage, distinguishing between the development component — where generative model use is documented — and the operational component — where it remains a founded hypothesis.

The relationship between BraZetsu and Ousaban, documented through shared distribution domain, does not establish whether Exilware directly operates the banking trojan or acquired infrastructure previously used by other operators.

Group-IB has released specific indicators of compromise, including domains and IP addresses associated with BraZetsu infrastructure. The source does not specify whether these IOCs have been shared with Brazilian authorities or the regional collective alert system.

Analysis: The Access Market Professionalizes Faster Than Defenses

BraZetsu does not represent a radical technological innovation. It represents an organizational innovation: the standardization of cybercrime as a service, with automated quality assurance and dynamic pricing. The shift from local banking fraud to global Initial Access Brokerage, executed by a Portuguese-speaking group in under seven months, signals that access commoditization is no longer the prerogative of Anglosphere markets.

For organizations in Latin America and Iberia, the operational consequence is an expanded attack surface. Internal compromise expertise is no longer required to breach a company: roughly six dollars and a buyer with a ready payload suffice. The threat multiplier cited by Group-IB is literal: every compromised host becomes a platform for further compromises, with traceability attenuated by the separation between seller and striker.

The AI component, still partially opaque, likely anticipates a broader trend rather than a singularity. If backend triage is confirmed, the compromise-assessment-sale cycle would shrink from hours to minutes, with impacts on incident response timelines that current frameworks do not cover.

Information is based on the cited advisory and current as of publication.

Sources

• https://thehackernews.com/2026/09/brazetsu-malware-turns-compromised.html
• https://thomasharris6.wordpress.com/2026/09/03/brazetsu-malware-turns-compromised-windows-hosts-into-criminal-marketplace-inventory/
• https://gbhackers.com/ai-enhanced-brazetsu-malware/
• https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace/
• https://nvd.nist.gov/vuln/detail/cve-2025-5777
• https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/
• https://nvd.nist.gov/#ok