Group-IB researchers have published a detailed analysis of BraZetsu, a sophisticated Python-based malware framework operated by a threat group called Exilware (believed to be Portuguese-speaking). BraZetsu’s central purpose is to turn compromised Windows machines into tradable access inventory on an underground service the operators call the “Infected Marketplace” (also known as “Banco de Infects” or infect[.]online). Once a host is compromised, Exilware catalogs it with an automated assessment of its commercial value — hardware specs, installed software, network profile, and banking-related application usage — then lists that access for purchase starting at around $5.80. Buyers can then remotely execute their own malware directly on the purchased host through a dedicated marketplace feature, without needing to break in themselves. Five distinct versions of BraZetsu have been identified since February 2026, when the framework first appeared in the wild.
The malware arrives via a loader masquerading as Microsoft Edge, downloaded from a distribution domain (caixaentradas1inboxshop[.]site) that has also delivered the Ousaban banking trojan. Delivery likely relies on social engineering. Once running, BraZetsu performs broad host reconnaissance, captures screenshots, records active application window titles (looking for banking keywords), and locates enterprise ERP software. A companion tool called CNABHunter specifically hunts for CNAB files — the fixed-width financial transaction format used between Brazilian businesses and banks — and can silently rewrite payment records to redirect funds to attacker-controlled bank accounts, PIX keys, or barcodes. Group-IB notes significant use of generative AI both in malware development and in automated triage of compromised host data. While the campaign focuses primarily on e-commerce, corporate, financial, law-enforcement, and industrial targets in Brazil and the Iberian Peninsula, the threat actor has also listed compromised hosts in the United States.