GROUP-IB threat intelligence has identified BraZetsu, a Python-based initial access framework attributed to the Brazilian actor Exilware, as an operational tool set sold on an underground marketplace. Described as an initial access broker (IAB) framework, BraZetsu is designed to aggressively map compromised networks to locate high-value financial assets and provide buyers with access to infected hosts.
Group-IB notes some samples remain undetectable by common antivirus engines such as VirusTotal, underscoring its stealth capabilities. The operator allegedly monetises compromised machines through a marketplace where initial access starts at about $5.80 per host.
The malware conducts rapid, in-depth reconnaissance on infected hosts, specifically seeking financial remittance files in formats like Brazil’s CNAB and harvesting browser histories from Chromium-based applications to profile victim activity. The framework reportedly uses artificial intelligence to process this data, potentially for backend triage and prioritisation.
BraZetsu authenticates and configures itself by retrieving encrypted configuration files from remote Pastebin URLs, and it actively checks for the presence of security controls to gauge host value. It also evaluates hardware metadata to prioritise targets. The operation is linked to Exilware’s Infected Marketplace (Banco de Infects), with social engineering suspected as a primary distribution vector, and it appears to be expanding beyond Latin America, with at least one US host advertised in April 2026.
Defenders are urged to monitor anomalous access patterns near ERP and financial directories, strengthen endpoint protection, review segmentation, and share threat intelligence to block emerging indicators of compromise. The report highlights an evolving AI-enhanced IAB ecosystem that requires coordinated, rapid defensive responses.