BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's Infected Marketplace IAB Operation
BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's (TL-2026-2250), also tracked as Infected Marketplace, is a high-severity malware campaign, first published 2026-08-31. It is attributed to Exilware with high confidence, affects Microsoft Windows (workstations and servers), maps to 16 MITRE ATT&CK techniques (T1005, T1010, T1012), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2250
- Threat ID
- TL-2026-2250
- Also known as
- Infected Marketplace, Banco de Infects
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-31
- Last reviewed
- 2026-08-31
- Attribution
- Exilware
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- financial-services, banking, government administration, police - law enforcement, health, cryptocurrency, insurance, logistics, ecommerce, telecommunications-isp, information-technology, cloud-devops
- Target regions
- brazil, spain, portugal, argentina, mexico, chile, paraguay, united states of america
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's
Malware and tooling: AgenteV2, BraZetsu, CNABHunter, Ousaban
Group-IB identified BraZetsu, a Nuitka-compiled Python Windows malware framework operated by Brazilian actor Exilware, that turns compromised systems into commercialized assets sold via the "Infected Marketplace" (aka "Banco de Infects"). The v5 build adds AI-assisted victim-value profiling atop reconnaissance, browser/CNAB banking-file harvesting, digital-certificate theft, and a WebSocket/TLS remote-shell C2, and remained fully undetected by all VirusTotal engines two months after discovery.
How BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's works
BraZetsu is a Python-based Windows malware framework, compiled to native executables with Nuitka, that Group-IB attributes with high confidence to the Brazilian threat actor Exilware. Rather than a conventional banking trojan, BraZetsu functions as an initial-access-broker (IAB) toolkit: it performs deep host reconnaissance (system, process, registry, and network enumeration across roughly 27 discovery functions), harvests Chromium-family browser history and profile data via direct SQLite queries, scans for Brazilian CNAB240/CNAB400 remittance files and ERP software (SAP, TOTVS, Senior, Sankhya, Alterdata, Nasajon), extracts PFX/P12 digital certificates, and pulls CPF/CNPJ personal identifiers via regex. Captured intelligence is automatically tagged across 20+ categories (e-commerce platforms, EDR products, law-enforcement hostname prefixes, SCADA/ICS software, healthcare ERPs, cryptocurrency wallets, and banking-security agents) to price and market each infected host.
Operators reach infected hosts through a WebSocket-over-TLS channel on port 8443, supporting interactive remote-shell execution and SD/HD screenshot capture. Configuration is delivered via a Pastebin dead-drop resolver, XOR-encrypted with the key "p4st3_s3cr3t_k3y" and Base64-encoded, letting operators rotate C2 infrastructure without recompiling the implant. The latest (v5) build adds an AI-assisted layer: internal log strings reference collecting "hardware and machine port metadata for server AI" and flagging files as "priority target[s] for AI," indicating a backend model triages and prioritizes stolen data before it is listed for sale.
Access to compromised hosts is monetized through the "Infected Marketplace" (Portuguese: "Banco de Infects"), reachable at infect[.]online and infectonline[.]store and hosted on a Contabo GmbH VPS at 38.242.246.176. Buyers fund accounts with a minimum ~BRL 30 (~$5.80 USD) deposit via the NowPayments cryptocurrency processor and must settle within 24-49 hours depending on infection volume; Exilware operates the marketplace with a secondary vendor, SpamPower. Group-IB found BraZetsu had remained fully undetected (FUD) by every VirusTotal engine two months after the initial samples were collected.
Group-IB assesses with high confidence that BraZetsu shares a codebase, build methodology, and infrastructure with the previously documented agenteV2 stealer/backdoor: both are Nuitka-compiled, both implement an identical WebSocket backdoor and Pastebin C2 pattern, and both share loader filenames. Independent research corroborates this overlap directly — ANY.RUN's agenteV2 writeup documents the real C2 server at 38.242.246.176:8443, the exact IP Group-IB lists as the Infected Marketplace's Contabo hosting address, giving a first-party infrastructure link between the two campaigns rather than a name-only association. BraZetsu's distribution domain caixaentradas1inboxshop[.]site is also used to deliver the unrelated-lineage Ousaban banking trojan, and BraZetsu overlaps in CNAB-targeting logic and ERP directory paths with the separately disclosed CNABHunter fraud tool, though Group-IB treats CNABHunter as an autonomous fraud tool rather than the same IAB framework.
Initial access is believed to rely on social engineering — VBS script downloaders masquerading as legal notifications ("processo de intimação") and loaders disguised as legitimate software (e.g., a fake Microsoft Edge update, msedge04.exe) — rather than a software vulnerability; no CVE is associated with this threat. Persistence is established via a "MonitorSystem" registry Run key. Portuguese-language log strings with natural idiom, plus extensive emoji-laden logging, support both native-speaker attribution and Group-IB's assessment that LLM-generated code contributed to the framework. Targeting has concentrated on Brazil, expanding to the Iberian Peninsula (Spain, Portugal) and Latin America (Argentina, Mexico, Chile, Paraguay), with compromised U.S. hosts advertised on the marketplace as of April 2026 — a signal of further geographic expansion.
MITRE ATT&CK techniques used in TL-2026-2250
Collection
T1005 Data from Local System; T1113 Screen Capture
Discovery
T1010 Application Window Discovery; T1012 Query Registry; T1046 Network Service Discovery; T1082 System Information Discovery; T1217 Browser Information Discovery; T1518 Software Discovery
Defense Evasion
T1027.002 Software Packing; T1564.003 Hidden Window
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File
Command and Control
Persistence
T1547.001 Registry Run Keys / Startup Folder
Credential Access
Affected products and versions in BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's
- Microsoft — Windows (workstations and servers)
Vulnerable versions: No specific version constraint — infection relies on social engineering, not a software vulnerability
Remediation for BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's
Immediate actions
- Block/alert on indicator domains and IPs: c2.installscenter.com, infect.online, infectonline.store, caixaentradas1inboxshop.site, 38.242.246.176, 69.49.241.120
- Hunt for the 'MonitorSystem' registry Run-key persistence artifact and loader filenames (msdege[0-9].exe, wifi_driver.exe, msedge04.exe, temp_agente.dll) across Windows endpoints
- Alert on outbound WebSocket/TLS connections to non-standard port 8443 originating from workstation subnets
Workarounds
- Block or quarantine VBS script attachments/downloads at the email and endpoint layer
- Train staff to recognize fake legal-notice ('processo de intimação') phishing lures used as the initial infection vector
Longer-term hardening
- Deploy EDR/behavioral detection tuned to Nuitka-compiled Python executables masquerading as browser or driver binaries
- Restrict or closely monitor Pastebin and similar paste-site access from corporate endpoints, a recurring dead-drop C2 resolver pattern in this malware family
- Enforce CNAB/remittance-file integrity checks (hash or checksum validation) between ERP generation and bank submission to counter CNAB-targeting overlap with the related CNABHunter tool
Timeline of BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's
- Group-IB identifies the earliest BraZetsu build (v1), providing basic remote access and Windows registry Run-key persistence (month-level precision only; exact day not disclosed).
- Compromised U.S. hosts are advertised on the Infected Marketplace, marking the first observed expansion beyond Brazil/Iberia/LatAm targeting (month-level precision only).
- ANY.RUN documents the related agenteV2 banking-trojan framework, sharing BraZetsu's Nuitka compilation, WebSocket backdoor design, and the same Contabo-hosted C2 IP 38.242.246.176:8443 (month-level precision only).
- FortiGuard Labs identifies an Ousaban banking-trojan campaign targeting Spain and Portugal, sharing BraZetsu's caixaentradas1inboxshop.site distribution domain (month-level precision only).
- The related CNAB-targeting fraud tool CNABHunter is publicly disclosed, overlapping with BraZetsu in CNAB240/CNAB400 file targeting and ERP directory paths.
- BraZetsu evolves into its v5 build, an 'AI-enhanced intelligence-gathering platform' adding AI-assisted victim-value triage logic (month-level precision only).
- Group-IB publishes the BraZetsu / Exilware / Infected Marketplace research; the malware remains fully undetected (FUD) by all VirusTotal engines at time of publication.
Sources cited for BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's
- BraZetsu: AI-Enhanced IAB Marketplace
- Brazilian Phishing Campaign Deploys agenteV2 Stealer
- Inside agenteV2: How Brazilian Attackers Use Fake Court Summons to Steal Banking Credentials in Real Time
- Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures
- Ousaban: LATAM Banking Malware Abusing Cloud Services
- Ousaban: Private photo collection hidden in a CABinet
- #CNABHunter: o malware que aprendeu CNAB antes de atacar
- Alerta de Segurança: Malware CNABHunter
More in malware
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
Detection coverage for TL-2026-2250
As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2250 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.