AI-Enhanced BraZetsu Malware Powers Underground Market Selling Access to Corporate Networks

BraZetsu, a Python-based Windows malware framework allegedly operated by the Brazilian threat actor Exilware to identify, profile, and monetize compromised corporate systems.

Rather than behaving like a conventional infostealer, BraZetsu appears designed to support an Initial Access Broker operation, converting infected endpoints into cataloged access offerings for an underground marketplace.

The framework is reportedly the technical backbone of Exilware’s “Infected Marketplace,” also known as Banco de Infects, where criminal buyers can purchase access to compromised machines and deploy secondary payloads.

The model lowers the barrier to entry for ransomware affiliates, fraud groups, and other intruders by separating the initial compromise from follow-on exploitation.

BraZetsu is engineered to determine what a victim system is worth before it is listed for sale.

Its reconnaissance extends across corporate, financial, industrial, law-enforcement, healthcare, e-commerce, development, and IT-support environments.

The malware enumerates installed applications, processes, network services, browser profiles, active windows, recent files, host metadata, and security tooling.

It also looks for evidence of high-value enterprise systems, including SAP, TOTVS, Protheus, Warsaw, Topaz, Diebold, Veeam, Oracle, SQL Server, PostgreSQL, Docker, AWS credentials, Azure configuration directories, Kubernetes configuration files, and industrial platforms such as WinCC, RSLogix, and FactoryTalk.

A particularly notable capability is the malware’s search for Brazilian CNAB remittance files.

These files are used by organizations to send bulk payment instructions to banks, making their presence a strong indicator that a compromised endpoint may be connected to financial operations.

BraZetsu also hunts for .pfx and .p12 digital certificates, including certificates stored in user profiles and OneDrive locations.

The malware does not merely collect browser credentials in the way traditional stealers do.

It extracts browser history from Chromium-based browsers, including Chrome, Edge, Brave, Vivaldi, and Opera, then compares URLs against a list of nearly 230 targeted domains and paths.

This gives operators a behavioral profile of the victim, revealing the financial platforms, ERP portals, administrative consoles, cloud services, and business applications they use.

The assessment is not proof that every component was AI-generated, but embedded strings go further by indicating that the command-and-control backend may use an AI engine to process stolen metadata and prioritize valuable files or systems.

That is the significant shift. AI-assisted development can accelerate iterative malware updates, while backend triage can help an access broker sort thousands of compromised machines by commercial value.

Group-IB said in a report shared with GBhackers, BraZetsu contains verbose Portuguese-language logging, emoji-heavy status messages, and development artifacts that suggest extensive use of generative AI during malware development.

AI-Enhanced BraZetsu Malware

A workstation with access to an ERP platform, banking software, DevOps secrets, digital certificates, or a SCADA environment is far more attractive to buyers than an ordinary consumer endpoint.

BraZetsu’s evolution reportedly began in February 2026 with basic remote-access functions before progressing into a broader intelligence-gathering platform.

Recent variants support remote shell commands, screenshot capture, worker-module deployment, system inventory, network enumeration, and encrypted configuration retrieval through a Pastebin-based dead-drop resolver.

The researchers linked BraZetsu infrastructure to the Exilware-operated Infect Marketplace, which allegedly sells access to compromised hosts for a low entry cost.

The platform’s commercial design allows buyers to acquire pre-compromised systems, execute additional payloads remotely, and pursue their own objectives without investing in phishing infrastructure or malware development.

Group-IB assesses with high confidence that BraZetsu is the primary framework replenishing the marketplace’s inventory.

The operation has historically concentrated on Brazil and the broader Iberian and Latin American region, but researchers also observed U.S.-based compromised systems advertised in April 2026, suggesting a possible expansion beyond its traditional footprint.

The framework also overlaps with the previously documented agenteV2 campaign.

ANY.RUN reported that agenteV2 uses phishing lures impersonating Brazilian judicial notices, a persistent WebSocket backdoor, screen streaming, remote shell access, Pastebin-based C2 resolution, and Nuitka-compiled Python payloads.

That campaign demonstrates how phishing-delivered access tools can transition from financial fraud into persistent, operator-driven intrusions.

Organizations operating in Brazil and Latin America should treat BraZetsu as an access-broker threat, not only a banking malware problem.

Security teams should monitor for suspicious VBScript execution, unauthorized scheduled tasks, registry Run-key persistence, outbound TLS traffic over port 8443.

Browser-database copying to temporary folders, and endpoint enumeration targeting ERP, banking, backup, industrial, and cloud-development tooling.

The use of dead-drop resolvers also means static IP blocking is insufficient.

Defenders should combine endpoint behavior analytics with DNS, proxy, network, and threat-intelligence monitoring to identify infrastructure changes and isolate affected systems quickly.

Group-IB’s Threat Intelligence Platform highlights the broader value of correlating malware artifacts, malicious infrastructure, dark-web activity, and attacker tradecraft to turn isolated indicators into actionable response data.

IOCs

IOC Type	Indicator	Notes
URL	hxxps://pastebin[.]com/raw/aF0WCxia	Pastebin raw-content URL
URL	hxxps://pastebin[.]com/raw/hM0nXNBP	Pastebin raw-content URL
URL	hxxps://pastebin[.]com/raw/9ChwVzzw	Pastebin raw-content URL
Domain	c2[.]installscenter[.]com	Suspected command-and-control subdomain
Domain	infectonline[.]store	Suspicious domain
Domain	infect[.]online	Suspicious domain
IPv4 address	38[.]242[.]246[.]176	Suspected remote infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide