Verticals Targeted: Finance, Enterprise, Government, Industrial
Regions Targeted: Brazil, Latin America, Spain, US
Related Threat Actors: Exilware
Related Families: AgenteV2, CNABHunter
Executive Summary
BraZetsu is a Python-based Windows malware framework attributed to the Brazilian threat actor Exilware. Designed to support Initial Access Broker operations, BraZetsu performs automated reconnaissance to identify and prioritize high-value compromised systems for monetization through Exilware’s Infect Marketplace. The framework targets financial, corporate, industrial, and government environments and supports extensive intelligence collection and remote access capabilities. BraZetsu has rapidly evolved since February 2026, with recent versions incorporating increasingly sophisticated host profiling and indications of AI-assisted development and backend target prioritization.
Key Takeaways
- BraZetsu is an IAB-oriented Windows malware framework that performs extensive automated reconnaissance to identify and classify compromised systems with potentially valuable financial, corporate, administrative, industrial, or infrastructure characteristics.
- Group-IB attributes BraZetsu to Exilware with high confidence and assesses that the malware supplies compromised hosts to Exilware’s Infect Marketplace, where access can be sold to other cybercriminals for follow-on operations.
- BraZetsu combines automated intelligence collection with interactive remote access, including browser-history analysis, financial-file and digital-certificate discovery, system and software profiling, screenshot capture, and arbitrary Windows shell command execution.
- BraZetsu appears to incorporate generative AI at multiple points in its ecosystem. Group-IB identified indicators consistent with AI-assisted development as well as embedded references to server-side AI used for data processing and target prioritization, although the backend implementation has not been independently characterized.
Background
Group-IB has identified BraZetsu, a Python-based Windows malware framework attributed with high confidence to the Brazilian threat actor Exilware. Rather than operating as a conventional information stealer, BraZetsu is designed to support Initial Access Broker (IAB) operations by conducting extensive reconnaissance of compromised systems, identifying high-value environments, and feeding those systems into Exilware’s underground Infect Marketplace, also known as “Banco de Infects.”
BraZetsu profiles infected hosts for the presence of financial systems, enterprise resource planning (ERP) software, industrial control environments, e-commerce platforms, security products, development infrastructure, government systems, and other potentially valuable resources. The malware can collect browser history, financial remittance files, digital certificates, system and process information, screenshots, and other intelligence while also providing operators with arbitrary remote command execution.
Group-IB traced BraZetsu’s development to at least February 2026 and identified five distinct versions. The framework progressed from relatively basic remote-access functionality into a specialized IAB reconnaissance platform capable of automatically categorizing compromised systems according to their potential commercial value. The framework also appears to incorporate generative AI into portions of its development and potentially its backend intelligence-processing workflow.
Technical Analysis
Infection and Distribution
The exact initial infection mechanism used to deploy BraZetsu remains unknown. Group-IB identified distribution infrastructure associated with filenames including msedge[0-9].exe and wifi_driver.exe, which masquerade as legitimate software and drivers. The naming conventions and associated infrastructure suggest the use of social engineering.
Group-IB also identified Visual Basic Script files associated with the distribution infrastructure that download subsequent attack stages. Some scripts masqueraded as Portuguese-language legal notification processes, further supporting the assessment that social engineering plays a role in delivery. The same infrastructure was also observed delivering an Ousaban banking Trojan sample.
C2 Configuration and Communications
BraZetsu uses an external configuration mechanism rather than relying exclusively on a statically embedded C2 address. The malware’s get_server_config() function retrieves an encrypted and Base64-encoded configuration from a specified Pastebin URL. The _dec() function subsequently Base64 decodes the data and decrypts it using XOR with the hardcoded key p4st3_s3cr3t_k3y. The resulting configuration contains three pipe-delimited values: <c2_domain>|<port>|<auth_token>.
This architecture provides Exilware with a dead-drop mechanism through which active C2 infrastructure can be changed without rebuilding or redistributing the malware. Group-IB additionally identified BraZetsu communicating through an interactive WebSocket backdoor over TLS port 8443. The channel supports bidirectional communication and functionality including remote shell execution and screenshot capture.
System Reconnaissance and IAB Profiling
Reconnaissance is central to BraZetsu’s functionality. The latest analyzed version contains 27 distinct functions, most associated with automated enumeration and intelligence gathering. BraZetsu collects basic host information including the username, hostname, operating system version, active processes, recently accessed files, installed software, and network-related information. It queries Windows uninstall registry locations to enumerate installed applications and examines active processes and network services.
The get_stealth_iab_tags() functionality performs approximately 20 checks using environment variables, running processes, ports, filenames, hostname patterns, and other indicators. Based on the results, infected hosts can be tagged according to their potential value. The checks include environment variables associated with AWS, Azure, and Kubernetes; processes associated with SAP, TOTVS, Warsaw, and other financial software; SCADA products including WinCC, RSLogix, and FactoryTalk; backup software such as Veeam; and security products including Microsoft Defender, CrowdStrike, and SentinelOne. This automated classification enables BraZetsu to do more than determine whether a host has been successfully compromised. It helps Exilware assess what type of environment has been compromised and how commercially valuable that access may be.
Browser Intelligence
BraZetsu specifically profiles Chromium-based browsers, including Google Chrome, Microsoft Edge, Brave, Vivaldi, and Opera. Rather than behaving like a conventional browser credential stealer, BraZetsu focuses on browser history. It enumerates browser profiles and queries SQLite history databases for URLs, titles, and visit counts. Collected history is cross-referenced against a global list containing nearly 230 targeted domains and URL paths spanning multiple industries. This provides intelligence about the infected user’s activities and can help identify systems associated with potentially valuable corporate, financial, administrative, or infrastructure environments. Group-IB also identified BraZetsu and the related AgenteV2 activity using shutil.copyfile to copy Chrome and Microsoft Edge databases into %TEMP%, bypassing SQLite file locks while browsers remain open.
Financial Reconnaissance
BraZetsu performs specialized reconnaissance targeting Brazilian financial environments. The framework searches for CNAB files, standardized remittance files used by Brazilian businesses to transmit financial instructions to banks. BraZetsu also examines systems for banking and ERP applications and monitors active window titles for banking-related keywords. Although this functionality overlaps with the separate CNABHunter malware, Group-IB found no evidence that BraZetsu automatically modifies CNAB files. CNABHunter is designed to manipulate legitimate payment instructions to facilitate fraud, whereas BraZetsu identifies financial assets as part of its broader IAB reconnaissance workflow.
Digital Certificate and Identity Collection
BraZetsu searches recursively for .PFX and .P12 digital certificate files within user profiles and OneDrive locations. Operational logging indicates that discovered certificates are bundled with a machine dossier and transmitted to the C2 infrastructure. The framework also contains functionality associated with identifying Brazilian CPF and CNPJ identifiers using regular expressions. Group-IB notes that the internal mechanics of this functionality are not completely understood. Together, these capabilities provide additional information that may assist operators in determining the identity, organizational context, and potential value of an infected host.
Remote Operator Capabilities
BraZetsu combines autonomous reconnaissance with interactive operator access. The run_shell_commands function executes arbitrary commands through the Windows Command Shell (cmd.exe), providing remote operators with hands-on control over compromised systems. The capture_screen function captures screenshots in either SD or HD quality and converts the resulting image into a Base64-encoded representation. BraZetsu can also launch additional worker instances through _execute_worker, allowing supplementary modules or payloads to be deployed on an infected system. These capabilities are particularly significant within the IAB model because access sold through the associated marketplace can serve as a staging point for additional malicious activity performed by third-party customers.
Persistence and Evasion
The earliest identified BraZetsu version established persistence using a Windows Registry Run key named MonitorSystem. Later versions incorporated increasingly sophisticated reconnaissance and evasion functionality as the framework matured. BraZetsu also contains a hide_console function designed to conceal console-window activity during execution. The malware is written in Python 3 and compiled using Nuitka into standalone Windows executables, an approach that can complicate reverse engineering and signature-based detection.
BraZetsu Evolution
Group-IB identified five distinct BraZetsu versions dating to February 2026:
- BraZetsu v1 primarily provided remote access and used a simpler configuration containing PASTEBIN_URL and AUTH_TOKEN. It established persistence using the MonitorSystem Registry Run key.
- BraZetsu v2 added the hardcoded XOR key used to protect C2 configuration data and expanded targeting toward major e-commerce and financial platforms in Brazil, Argentina, Mexico, and Chile. It also began scanning for .rem and .retfinancial files.
- BraZetsu v3 and v4 shifted toward deeper reconnaissance of Brazilian corporate environments. Targeting expanded to ERP and business-management platforms including Conta Azul, Omie, Bling, Tiny, Sankhya, and TOTVS. Collection expanded to include .cnab, .240, .400, .pfx, and .p12 files.
- BraZetsu v5 represents the framework’s transition into a comprehensive IAB platform, adding extensive business intelligence and automated host-profiling capabilities intended to determine the value of compromised environments.
The progression indicates deliberate development toward automating not merely compromise, but the commercial assessment of compromised access.
AI-Assisted Development and Target Prioritization
Group-IB assesses that BraZetsu’s extensive verbose logging and emoji usage are consistent with code produced with assistance from large language models, suggesting generative AI was used during development. More significantly, BraZetsu contains embedded strings explicitly referencing AI functionality on its C2 backend. These strings describe collecting hardware and machine information for “server AI” and determining whether files should be considered priority targets by AI.
This suggests AI may play a role in processing the large amount of reconnaissance data collected from infected systems and helping prioritize potentially valuable assets. The exact implementation of the backend AI system, the model or service involved, and the degree to which target selection is automated have not been established.
Who is Exilware?
Exilware is a Brazilian financially motivated cybercriminal actor associated with the development and operation of BraZetsu and the Infect Marketplace. Group-IB assesses with high confidence that BraZetsu provides the technical foundation for Exilware’s IAB business. Compromised systems are automatically profiled and subsequently commercialized through the marketplace, where customers can purchase access and remotely deploy additional malicious payloads.
Rather than broadly advertising access, Exilware appears to maintain a comparatively restricted marketplace. Customers are subject to spending requirements that force deposited funds to be used within short periods when new compromised systems become available. Group-IB assesses that this approach likely reduces operational exposure and limits the marketplace to a smaller customer network.
At least two vendors, operating as infect.online and SpamPower, were observed within the marketplace. Their exact relationship and any revenue-sharing arrangements remain unknown. Group-IB assesses with moderate confidence that Exilware relies on a restricted partner network to distribute BraZetsu and maintain the marketplace’s supply of compromised hosts.
Group-IB’s attribution of BraZetsu to Exilware is based on overlapping C2 and marketplace infrastructure, functionality enabling remote payload deployment through purchased access, geographic targeting consistent with Exilware’s market, and additional technical and operational evidence.
Analyst Commentary
BraZetsu demonstrates how the Initial Access Broker ecosystem is evolving beyond indiscriminate compromise toward automated identification and commercialization of high-value access. By examining browser activity, financial files, certificates, installed applications, running processes, network characteristics, and specialized enterprise software, BraZetsu can help distinguish ordinary compromised endpoints from systems associated with privileged, financial, industrial, cloud, government, or other potentially valuable environments. This creates a force multiplier for downstream threat actors: customers can acquire an established foothold that has already been profiled for potential value rather than beginning target discovery after gaining access. The framework’s remote command execution and secondary-payload capabilities further increase the risk that a BraZetsu infection can become the precursor to fraud, credential theft, data exfiltration, ransomware, or other higher-impact activity performed by separate operators.
BraZetsu also highlights the defensive limitations of relying on any single detection source against rapidly evolving malware. Group-IB reported that the latest identified BraZetsu version remained fully undetected by VirusTotal engines at the time of its analysis, while the framework itself evolved through five distinct versions within a matter of months. PolySwarm’s multi-engine threat detection reduces reliance on single-vendor detection models and increases the likelihood of detection when emerging or rapidly changing malware produces inconsistent results across security products. Aggregating independent analysis from specialized engines can provide early visibility into emerging threats and surface low-consensus or evolving malware that may otherwise evade conventional detection. For defenders, this broader detection perspective is particularly valuable against frameworks such as BraZetsu, where continued development, modular functionality, and an access-broker business model create opportunities for both the malware and subsequent payloads to change faster than individual detection pipelines can reliably characterize them.
IOCs
PolySwarm has multiple samples of BraZetsu.
f775fe06a4c2563cb03e1aa42eb4e9532840cce9dc168ea2ca97cee7972e6b17
54e313434a7f3fa349e439857e23ab536a95c9927cf62f8358b5cdd9fabf2700
91f225dcc7a01f926b03e8540d8b5e2d6c8e3763cc30f57381d702ce638fa6b0
d881a60ccd03b5417a1eed184143a18a333e7e9e9e351596a7a765843643af99
0fa785bb9f95b113539bb909da88e6cac9a433a07935571d9bcd2d85746fc5bf
1510823e7c80b4db5333dd18cd5992881496da30032d6d69b2a82e1c5cf30246
0cd0cc49ea4ff48c675368f725e183608494f22fefa92d2f33577f70bb6c0d5d
10de6185e31539cf01c8b05d9559e65e8693efd695f315de54667ef8c04de39c
bc91f90a5677404cf9c8f4bed7b36c22027b1549ffefee129b41fab3db3108b8
67fcfbdaab397ad1273135a3c6aa1d220ab76491cf945df081503401cc9732d2
c4dd46e5b450349fd9fbf686a5a22f55f8371123b098104db663a3980646e138
3f2f48525cf082672e38808480e214775e03dd943ff2df86172665aad96a5eaa
Click here to view all samples of BraZetsu in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
