Threat reportMalwareTL-2026-2250
BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's Infected Marketplace IAB Operation
Group-IB identified BraZetsu, a Nuitka-compiled Python Windows malware framework operated by Brazilian actor Exilware, that turns compromised systems into commercialized assets sold via the "Infected Marketplace" (aka "Banco de Infects"). The v5 build adds AI-assisted victim-value profiling atop reconnaissance, browser/CNAB banking-file harvesting, digital-certificate theft, and a WebSocket/TLS remote-shell C2, and remained fully undetected by all VirusTotal engines two months after discovery.
Key facts
| Identifiers | TL-2026-2250 |
|---|---|
| Also known as | Infected Marketplace, Banco de Infects |
| Severity | HIGH |
| Affected products | Microsoft Windows (workstations and servers) |
| Attribution | Exilware (high confidence) |
| Nation-state nexus | Brazil |
| Malware | AgenteV2, BraZetsu, CNABHunter, Ousaban |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1010 Application Window Discovery, T1012 Query Registry, T1016 System Network Configuration Discovery, T1027.002 Software Packing, T1041 Exfiltration Over C2 Channel, T1046 Network Service Discovery, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.005 Command and Scripting Interpreter, T1071.001 Web Protocols, T1082 System Information Discovery and 10 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | financial-services, banking, government administration, police - law enforcement, health, cryptocurrency, insurance, logistics, ecommerce, telecommunications-isp, information-technology, cloud-devops |
| Target regions | brazil, spain, portugal, argentina, mexico, chile, paraguay, united states of america |
| Detection rules | 9 (1 shown free) |
| Sources | 8 cited sources |
Detection coverage
As of 2026-10-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2250 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: BraZetsu VBS Downloader Spawning Fake Microsoft Edge / wifi_driver Loader
Detects wscript.exe/cscript.exe/mshta.exe spawning a process matching the BraZetsu/Exilware loader masquerade pattern (msdege[0-9].exe, msedge0[0-9].exe, wifi_driver.exe) or an msedge-named binary running outside Program Files. This is the initial-access execution stage: victims are lured by a fake 'processo de intimação' (legal notice) VBS attachment that drops a fake Microsoft Edge updater.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1204.002, T1059.001, T1059.003
- Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
- Severity: high
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lower=lower(ParentImage), image_lower=lower(Image)
| where (match(parent_lower, "wscript\.exe$") OR match(parent_lower, "cscript\.exe$") OR match(parent_lower, "mshta\.exe$"))
| where match(image_lower, "msdege[0-9]\.exe$") OR match(image_lower, "msedge0[0-9]\.exe$") OR match(image_lower, "wifi_driver\.exe$") OR (match(image_lower, "msedge") AND NOT match(image_lower, "\\program files\\"))
| table _time, ComputerName, User, ParentImage, Image, CommandLine, Hashes
| sort -_timeMicrosoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
| where FileName matches regex @"^(msdege[0-9]|msedge0[0-9]|wifi_driver)\.exe$"
or (FileName has "msedge" and FolderPath !contains @"Program Files")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine, SHA256
| order by Timestamp descSigma
title: BraZetsu VBS Downloader Spawning Fake Microsoft Edge Loader
id: 8a3f2e1c-4b6d-4e2a-9c7f-1d5e8a2b3f01
status: experimental
description: Detects wscript/cscript/mshta spawning a process named msdege[0-9].exe, msedge0[0-9].exe, or wifi_driver.exe, matching the BraZetsu/Exilware/agenteV2 loader masquerade delivered via fake court-summons ('processo de intimação') phishing lures.
references:
- https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace/
author: Threadlinqs Team
date: 2026/08/31
tags:
- attack.execution
- attack.t1204.002
- attack.t1059.001
- attack.t1059.003
- attack.tool.brazetsu
- attack.tool.agentev2
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
selection_child:
Image|re: '(?i).*\\(msdege[0-9]|msedge0[0-9]|wifi_driver)\.exe$'
condition: selection_parent and selection_child
falsepositives:
- IT-managed VBScript logon scripts that launch legitimate update utilities (rare; validate binary hash/signature before excluding)
level: highKnown false positives:
- Legitimate IT-managed VBScript/HTA logon or provisioning scripts that legitimately launch update utilities with similarly-named binaries; validate code signature and hash before allow-listing
Tuning notes: Extend the child-image regex as new loader filename variants surface (Exilware has iterated msdege0.exe -> msedge04.exe across builds); pivot on parent process being a script host rather than the exact filename to catch renamed variants, and cross-reference resulting binary hashes against the known BraZetsu SHA256 set.
- BraZetsu VBS Downloader Spawning Fake Microsoft Edge / wifi_driver Loader · unlock with TL Creds
- BraZetsu Post-Exploitation: MonitorSystem Persistence, PFX/P12 Certificate Theft, and ERP/CNAB Discovery · unlock with TL Creds
- BraZetsu WebSocket/TLS C2 Beacon and Pastebin Dead-Drop Config Resolver · unlock with TL Creds
- BraZetsu VBS Downloader Spawning Fake Microsoft Edge Loader · unlock with TL Creds
- BraZetsu MonitorSystem Persistence Run Key · unlock with TL Creds
- BraZetsu WebSocket TLS C2 Beacon or Pastebin Dead-Drop Resolver Access · unlock with TL Creds
- BraZetsu Post-Exploitation: MonitorSystem Persistence, PFX/P12 Certificate Theft, and ERP/CNAB Discovery · unlock with TL Creds
- BraZetsu WebSocket/TLS C2 Beacon and Pastebin Dead-Drop Config Resolver · unlock with TL Creds
Indicators of compromise
As of 2026-10-02, Threadlinqs Intelligence tracks 39 indicators of compromise for TL-2026-2250.
Sample indicators (3 of 39)
- IP address:
38.242.246[.]176 - Domain:
c2[.]installscenter[.]com - URL:
hxxps://pastebin[.]com/raw/0RmxqY57
Defanged, TLP:CLEAR. Full set of 39 indicators: unlock with TL Creds.
Technical analysis
BraZetsu is a Python-based Windows malware framework, compiled to native executables with Nuitka, that Group-IB attributes with high confidence to the Brazilian threat actor Exilware. Rather than a conventional banking trojan, BraZetsu functions as an initial-access-broker (IAB) toolkit: it performs deep host reconnaissance (system, process, registry, and network enumeration across roughly 27 discovery functions), harvests Chromium-family browser history and profile data via direct SQLite queries, scans for Brazilian CNAB240/CNAB400 remittance files and ERP software (SAP, TOTVS, Senior, Sankhya, Alterdata, Nasajon), extracts PFX/P12 digital certificates, and pulls CPF/CNPJ personal identifiers via regex. Captured intelligence is automatically tagged across 20+ categories (e-commerce platforms, EDR products, law-enforcement hostname prefixes, SCADA/ICS software, healthcare ERPs, cryptocurrency wallets, and banking-security agents) to price and market each infected host.
Operators reach infected hosts through a WebSocket-over-TLS channel on port 8443, supporting interactive remote-shell execution and SD/HD screenshot capture. Configuration is delivered via a Pastebin dead-drop resolver, XOR-encrypted with the key "p4st3_s3cr3t_k3y" and Base64-encoded, letting operators rotate C2 infrastructure without recompiling the implant. The latest (v5) build adds an AI-assisted layer: internal log strings reference collecting "hardware and machine port metadata for server AI" and flagging files as "priority target[s] for AI," indicating a backend model triages and prioritizes stolen data before it is listed for sale.
Access to compromised hosts is monetized through the "Infected Marketplace" (Portuguese: "Banco de Infects"), reachable at infect[.]online and infectonline[.]store and hosted on a Contabo GmbH VPS at 38.242.246.176. Buyers fund accounts with a minimum ~BRL 30 (~$5.80 USD) deposit via the NowPayments cryptocurrency processor and must settle within 24-49 hours depending on infection volume; Exilware operates the marketplace with a secondary vendor, SpamPower. Group-IB found BraZetsu had remained fully undetected (FUD) by every VirusTotal engine two months after the initial samples were collected.
Group-IB assesses with high confidence that BraZetsu shares a codebase, build methodology, and infrastructure with the previously documented agenteV2 stealer/backdoor: both are Nuitka-compiled, both implement an identical WebSocket backdoor and Pastebin C2 pattern, and both share loader filenames. Independent research corroborates this overlap directly — ANY.RUN's agenteV2 writeup documents the real C2 server at 38.242.246.176:8443, the exact IP Group-IB lists as the Infected Marketplace's Contabo hosting address, giving a first-party infrastructure link between the two campaigns rather than a name-only association. BraZetsu's distribution domain caixaentradas1inboxshop[.]site is also used to deliver the unrelated-lineage Ousaban banking trojan, and BraZetsu overlaps in CNAB-targeting logic and ERP directory paths with the separately disclosed CNABHunter fraud tool, though Group-IB treats CNABHunter as an autonomous fraud tool rather than the same IAB framework.
Initial access is believed to rely on social engineering — VBS script downloaders masquerading as legal notifications ("processo de intimação") and loaders disguised as legitimate software (e.g., a fake Microsoft Edge update, msedge04.exe) — rather than a software vulnerability; no CVE is associated with this threat. Persistence is established via a "MonitorSystem" registry Run key. Portuguese-language log strings with natural idiom, plus extensive emoji-laden logging, support both native-speaker attribution and Group-IB's assessment that LLM-generated code contributed to the framework. Targeting has concentrated on Brazil, expanding to the Iberian Peninsula (Spain, Portugal) and Latin America (Argentina, Mexico, Chile, Paraguay), with compromised U.S. hosts advertised on the marketplace as of April 2026 — a signal of further geographic expansion.
MITRE ATT&CK techniques by tactic:
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1010 Application Window Discovery; T1012 Query Registry; T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery; T1518 Software Discovery
Defense Evasion
T1027.002 Software Packing; T1564.003 Hidden Window
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Command and Scripting Interpreter; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Web Service; T1105 Ingress Tool Transfer
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
Remediation
Immediate actions
- Block/alert on indicator domains and IPs: c2.installscenter.com, infect.online, infectonline.store, caixaentradas1inboxshop.site, 38.242.246.176, 69.49.241.120
- Hunt for the 'MonitorSystem' registry Run-key persistence artifact and loader filenames (msdege[0-9].exe, wifi_driver.exe, msedge04.exe, temp_agente.dll) across Windows endpoints
- Alert on outbound WebSocket/TLS connections to non-standard port 8443 originating from workstation subnets
Workarounds
- Block or quarantine VBS script attachments/downloads at the email and endpoint layer
- Train staff to recognize fake legal-notice ('processo de intimação') phishing lures used as the initial infection vector
Longer-term hardening
- Deploy EDR/behavioral detection tuned to Nuitka-compiled Python executables masquerading as browser or driver binaries
- Restrict or closely monitor Pastebin and similar paste-site access from corporate endpoints, a recurring dead-drop C2 resolver pattern in this malware family
- Enforce CNAB/remittance-file integrity checks (hash or checksum validation) between ERP generation and bank submission to counter CNAB-targeting overlap with the related CNABHunter tool
Affected and fixed versions
- Microsoft — Windows (workstations and servers)
Vulnerable versions: No specific version constraint — infection relies on social engineering, not a software vulnerability
Timeline
Last updated · revalidated 1× · latest source
- Group-IB identifies the earliest BraZetsu build (v1), providing basic remote access and Windows registry Run-key persistence (month-level precision only; exact day not disclosed).
- Compromised U.S. hosts are advertised on the Infected Marketplace, marking the first observed expansion beyond Brazil/Iberia/LatAm targeting (month-level precision only).
- ANY.RUN documents the related agenteV2 banking-trojan framework, sharing BraZetsu's Nuitka compilation, WebSocket backdoor design, and the same Contabo-hosted C2 IP locked-ioc-27:8443 (month-level precision only).
- FortiGuard Labs identifies an Ousaban banking-trojan campaign targeting Spain and Portugal, sharing BraZetsu's locked-ioc-22 distribution domain (month-level precision only).
- The related CNAB-targeting fraud tool CNABHunter is publicly disclosed, overlapping with BraZetsu in CNAB240/CNAB400 file targeting and ERP directory paths.
- BraZetsu evolves into its v5 build, an 'AI-enhanced intelligence-gathering platform' adding AI-assisted victim-value triage logic (month-level precision only).
- Group-IB publishes the BraZetsu / Exilware / Infected Marketplace research; the malware remains fully undetected (FUD) by all VirusTotal engines at time of publication.
- The Hacker News and other outlets report Group-IB's BraZetsu research, including the AI-based victim-value triage and BRL 30 access pricing.
Update history
- 2026-10-02 — BraZetsu: Python-based IAB malware framework by Exilware feeding the 'Infected Marketplace': What changed Severity HIGH and exploitability ACTIVE unchanged. Nation-state set from Unknown to Brazil (Group-IB assesses a Brazilian actor; existing record already describes Exilware as Brazilian).
Sources cited
- Alerta de Segurança: Malware CNABHunter idealsoft.com.br · Advisory · 2026-05-01
- BraZetsu: AI-Enhanced IAB Marketplace group-ib.com · Vendor report · 2026-08-31
- Brazilian Phishing Campaign Deploys agenteV2 Stealer any.run · Research · 2026-04-01
- Ousaban: LATAM Banking Malware Abusing Cloud Services netskope.com · Vendor report · 2026-05-01
- Ousaban: Private photo collection hidden in a CABinet ESET WeLiveSecurity · Research · 2021-05-05
- Inside agenteV2: How Brazilian Attackers Use Fake Court Summons to Steal Banking Credentials in Real Time medium.com · Blog · 2026-04-01
- Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures The Hacker News · News · 2026-07-01
- #CNABHunter: o malware que aprendeu CNAB antes de atacar motorfiscal.com.br · News · 2026-05-07
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .
