# BraZetsu: AI-Enhanced Malware Toolkit Powers Exilware's Infected Marketplace IAB Operation

> Group-IB identified BraZetsu, a Nuitka-compiled Python Windows malware framework operated by Brazilian actor Exilware, that turns compromised systems into commercialized assets sold via the "Infected Marketplace" (aka "Banco de Infects"). The v5 build adds AI-assisted victim-value profiling atop reconnaissance, browser/CNAB banking-file harvesting, digital-certificate theft, and a WebSocket/TLS remote-shell C2, and remained fully undetected by all VirusTotal engines two months after discovery.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-10-02T12:53:15.667Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2250
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-brazetsu-infected-marketplace-iab-tl-2026-2250.webp?v=1f105c5a (Threadlinqs threat intel: BraZetsu Infected Marketplace: Detection & IOCs (TL-2026-2250) — High severity, 39 IOCs, 9 detection rules.)
- **ID:** TL-2026-2250
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Exilware (Brazil)
- **Detections:** 9 (1 shown free below) · **IOCs:** 39 (3 shown free below)

## Description

BraZetsu is a Python-based Windows malware framework, compiled to native executables with Nuitka, that Group-IB attributes with high confidence to the Brazilian threat actor Exilware. Rather than a conventional banking trojan, BraZetsu functions as an initial-access-broker (IAB) toolkit: it performs deep host reconnaissance (system, process, registry, and network enumeration across roughly 27 discovery functions), harvests Chromium-family browser history and profile data via direct SQLite queries, scans for Brazilian CNAB240/CNAB400 remittance files and ERP software (SAP, TOTVS, Senior, Sankhya, Alterdata, Nasajon), extracts PFX/P12 digital certificates, and pulls CPF/CNPJ personal identifiers via regex. Captured intelligence is automatically tagged across 20+ categories (e-commerce platforms, EDR products, law-enforcement hostname prefixes, SCADA/ICS software, healthcare ERPs, cryptocurrency wallets, and banking-security agents) to price and market each infected host.

Operators reach infected hosts through a WebSocket-over-TLS channel on port 8443, supporting interactive remote-shell execution and SD/HD screenshot capture. Configuration is delivered via a Pastebin dead-drop resolver, XOR-encrypted with the key "p4st3_s3cr3t_k3y" and Base64-encoded, letting operators rotate C2 infrastructure without recompiling the implant. The latest (v5) build adds an AI-assisted layer: internal log strings reference collecting "hardware and machine port metadata for server AI" and flagging files as "priority target[s] for AI," indicating a backend model triages and prioritizes stolen data before it is listed for sale.

Access to compromised hosts is monetized through the "Infected Marketplace" (Portuguese: "Banco de Infects"), reachable at infect[.]online and infectonline[.]store and hosted on a Contabo GmbH VPS at 38.242.246.176. Buyers fund accounts with a minimum ~BRL 30 (~$5.80 USD) deposit via the NowPayments cryptocurrency processor and must settle within 24-49 hours depending on infection volume; Exilware operates the marketplace with a secondary vendor, SpamPower. Group-IB found BraZetsu had remained fully undetected (FUD) by every VirusTotal engine two months after the initial samples were collected.

Group-IB assesses with high confidence that BraZetsu shares a codebase, build methodology, and infrastructure with the previously documented agenteV2 stealer/backdoor: both are Nuitka-compiled, both implement an identical WebSocket backdoor and Pastebin C2 pattern, and both share loader filenames. Independent research corroborates this overlap directly — ANY.RUN's agenteV2 writeup documents the real C2 server at 38.242.246.176:8443, the exact IP Group-IB lists as the Infected Marketplace's Contabo hosting address, giving a first-party infrastructure link between the two campaigns rather than a name-only association. BraZetsu's distribution domain caixaentradas1inboxshop[.]site is also used to deliver the unrelated-lineage Ousaban banking trojan, and BraZetsu overlaps in CNAB-targeting logic and ERP directory paths with the separately disclosed CNABHunter fraud tool, though Group-IB treats CNABHunter as an autonomous fraud tool rather than the same IAB framework.

Initial access is believed to rely on social engineering — VBS script downloaders masquerading as legal notifications ("processo de intimação") and loaders disguised as legitimate software (e.g., a fake Microsoft Edge update, msedge04.exe) — rather than a software vulnerability; no CVE is associated with this threat. Persistence is established via a "MonitorSystem" registry Run key. Portuguese-language log strings with natural idiom, plus extensive emoji-laden logging, support both native-speaker attribution and Group-IB's assessment that LLM-generated code contributed to the framework. Targeting has concentrated on Brazil, expanding to the Iberian Peninsula (Spain, Portugal) and Latin America (Argentina, Mexico, Chile, Paraguay), with compromised U.S. hosts advertised on the marketplace as of April 2026 — a signal of further geographic expansion.

## MITRE ATT&CK

- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1027.002 Software Packing
- T1564.003 Hidden Window
- T1552.004 Private Keys
- T1012 Query Registry
- T1518 Software Discovery
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1010 Application Window Discovery
- T1217 Browser Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1059.005 Command and Scripting Interpreter
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1102.001 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BraZetsu VBS Downloader Spawning Fake Microsoft Edge / wifi_driver Loader** (`TL-2026-2250-SPL-001`)

Detects wscript.exe/cscript.exe/mshta.exe spawning a process matching the BraZetsu/Exilware loader masquerade pattern (msdege[0-9].exe, msedge0[0-9].exe, wifi_driver.exe) or an msedge-named binary running outside Program Files. This is the initial-access execution stage: victims are lured by a fake 'processo de intimação' (legal notice) VBS attachment that drops a fake Microsoft Edge updater.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.001, T1059.003
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lower=lower(ParentImage), image_lower=lower(Image)
| where (match(parent_lower, "wscript\.exe$") OR match(parent_lower, "cscript\.exe$") OR match(parent_lower, "mshta\.exe$"))
| where match(image_lower, "msdege[0-9]\.exe$") OR match(image_lower, "msedge0[0-9]\.exe$") OR match(image_lower, "wifi_driver\.exe$") OR (match(image_lower, "msedge") AND NOT match(image_lower, "\\program files\\"))
| table _time, ComputerName, User, ParentImage, Image, CommandLine, Hashes
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
| where FileName matches regex @"^(msdege[0-9]|msedge0[0-9]|wifi_driver)\.exe$"
    or (FileName has "msedge" and FolderPath !contains @"Program Files")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: BraZetsu VBS Downloader Spawning Fake Microsoft Edge Loader
id: 8a3f2e1c-4b6d-4e2a-9c7f-1d5e8a2b3f01
status: experimental
description: Detects wscript/cscript/mshta spawning a process named msdege[0-9].exe, msedge0[0-9].exe, or wifi_driver.exe, matching the BraZetsu/Exilware/agenteV2 loader masquerade delivered via fake court-summons ('processo de intimação') phishing lures.
references:
  - https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace/
author: Threadlinqs Team
date: 2026/08/31
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1059.003
  - attack.tool.brazetsu
  - attack.tool.agentev2
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_child:
    Image|re: '(?i).*\\(msdege[0-9]|msedge0[0-9]|wifi_driver)\.exe$'
  condition: selection_parent and selection_child
falsepositives:
  - IT-managed VBScript logon scripts that launch legitimate update utilities (rare; validate binary hash/signature before excluding)
level: high
```

**Known false positives:**

- Legitimate IT-managed VBScript/HTA logon or provisioning scripts that legitimately launch update utilities with similarly-named binaries; validate code signature and hash before allow-listing

**Tuning notes:** Extend the child-image regex as new loader filename variants surface (Exilware has iterated msdege0.exe -> msedge04.exe across builds); pivot on parent process being a script host rather than the exact filename to catch renamed variants, and cross-reference resulting binary hashes against the known BraZetsu SHA256 set.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BraZetsu VBS Downloader Spawning Fake Microsoft Edge / wifi_driver Loader (locked: unlock with TL Creds)
- BraZetsu Post-Exploitation: MonitorSystem Persistence, PFX/P12 Certificate Theft, and ERP/CNAB Discovery (locked: unlock with TL Creds)
- BraZetsu WebSocket/TLS C2 Beacon and Pastebin Dead-Drop Config Resolver (locked: unlock with TL Creds)
- BraZetsu VBS Downloader Spawning Fake Microsoft Edge Loader (locked: unlock with TL Creds)
- BraZetsu MonitorSystem Persistence Run Key (locked: unlock with TL Creds)
- BraZetsu WebSocket TLS C2 Beacon or Pastebin Dead-Drop Resolver Access (locked: unlock with TL Creds)
- BraZetsu Post-Exploitation: MonitorSystem Persistence, PFX/P12 Certificate Theft, and ERP/CNAB Discovery (locked: unlock with TL Creds)
- BraZetsu WebSocket/TLS C2 Beacon and Pastebin Dead-Drop Config Resolver (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 39)

Defanged, TLP:CLEAR.

- IP address: `38.242.246[.]176`
- Domain: `c2[.]installscenter[.]com`
- URL: `hxxps://pastebin[.]com/raw/0RmxqY57`

Full set of 39 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BraZetsu: AI-Enhanced IAB Marketplace](https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace/)
- [Brazilian Phishing Campaign Deploys agenteV2 Stealer](https://any.run/cybersecurity-blog/brazilian-banking-phishing-campaign/)
- [Inside agenteV2: How Brazilian Attackers Use Fake Court Summons to Steal Banking Credentials in Real Time](https://medium.com/@anyrun/inside-agentev2-how-brazilian-attackers-use-fake-court-summons-to-steal-banking-credentials-in-30394867eb6a)
- [Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures](https://thehackernews.com/2026/07/ousaban-banking-trojan-targets-iberian.html)
- [Ousaban: LATAM Banking Malware Abusing Cloud Services](https://www.netskope.com/blog/ousaban-latam-banking-malware-abusing-cloud-services)
- [Ousaban: Private photo collection hidden in a CABinet](https://www.welivesecurity.com/2021/05/05/ousaban-private-photo-collection-hidden-cabinet/)
- [#CNABHunter: o malware que aprendeu CNAB antes de atacar](https://motorfiscal.com.br/blog/cnabhunter-malware-cnab-fraude-fiscal/)
- [Alerta de Segurança: Malware CNABHunter](https://www.idealsoft.com.br/dicas_do_sistema/alerta-de-seguranca-malware-cnabhunter/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2250