BraZetsu Malware Framework Turns Corporate Networks into Products for Sale
A new Python-based malware framework, BraZetsu, is being used by threat actor Exilware to map compromised corporate networks and identify valuable data for sale on underground marketplaces.
A sophisticated new malware framework named BraZetsu is enabling threat actors to transform compromised corporate networks into marketable products. Developed by the threat group Exilware, this Python-based tool meticulously inventories victim systems, identifies high-value business data, and potentially utilizes artificial intelligence to assess the worth of compromised assets. The primary targets of this operation appear to be organizations located in Brazil and other regions within Latin America and Iberia.
BraZetsu is believed to be distributed through social engineering tactics, with attackers disguising malicious files as legitimate software updates or routine notices. Once executed, the malware establishes a covert channel, allowing operators to explore the compromised machine and deploy additional malicious payloads. Security researchers at Group-IB identified the framework and attributed it with high confidence to Exilware, noting that the operation has evolved from a basic remote-access tool into a specialized framework designed to support access brokers.
The implications of BraZetsu extend beyond simple data exfiltration. The malware's core function is to gather sufficient intelligence to package an infected company for sale on underground marketplaces. This creates a dangerous supply chain that can facilitate a range of subsequent criminal activities, including fraud, extensive data theft, and ransomware attacks, highlighting how access brokers are increasingly fueling ransomware operations.
Written in Python and compiled into Windows executables, BraZetsu employs techniques to evade standard signature-based detection. Recent samples exhibit a modular design, conceal console activity, and maintain persistent WebSocket connections with command-and-control (C2) infrastructure. A key feature is its extensive reconnaissance capabilities, which include inventorying devices, running programs, network ports, and software associated with critical business functions.
Further analysis reveals BraZetsu actively searches browser histories and financial remittance files, specifically looking for Brazilian CNAB formats. It also seeks digital certificates and indicators of enterprise resource planning (ERP), industrial control systems (ICS), development, backup, and security environments. The malware's 27 functions are heavily focused on discovering and cataloging valuable systems, with the ability to capture screenshots and execute remote commands, offering both automated data collection and interactive control.
Group-IB's report suggests that generative AI may have been used during the development of BraZetsu, evidenced by verbose logs and emoji-laden messages. More significantly, embedded strings indicate the potential for a server-side AI component to process stolen information, prioritize files, and evaluate hardware and machine details. While the full extent of AI integration across the attack lifecycle remains under investigation, this approach could dramatically alter the economics of cyber intrusions by enabling automated valuation and sale of compromised access.
Exilware has been operating its "Infect Marketplace" since February 2026, selling access to compromised hosts. BraZetsu appears to be the primary tool for replenishing this inventory, allowing buyers to remotely launch their own secondary malware. The low entry cost, reportedly around $5.80, significantly lowers the barrier for participation. While initial targets were primarily in Latin America, the advertisement of two U.S. hosts in April suggests a potential expansion beyond the operation's traditional regional focus.
For defenders, this model signifies that an initial infection may only be the first step in a multi-stage attack. Organizations are advised to implement robust logging and monitoring on critical systems, segment sensitive assets, and investigate suspicious activities such as unusual registry queries, software enumeration, searches for specific file types (.cnab, .pfx, .p12), and unauthorized WebSocket traffic. Additionally, blocking or restricting access to services like Pastebin, which BraZetsu uses for configuration data, and educating staff on verifying unexpected files remain crucial defenses against this evolving threat.