How BraZetsu Turns Infected Hosts into an Underground Marketplace Asset

Researchers at Group-IB have published a report on the modular malicious framework BraZetsu — a Python-based tool for Windows that turns compromised machines into a commodity on an underground initial access marketplace. Unlike typical infostealers, BraZetsu does more than just steal data: it catalogues infected systems, assesses their commercial value, and puts access to them up for sale via the Infected Marketplace platform. The framework primarily targets organizations in Brazil, the Iberian Peninsula, and Latin America in the e-commerce, financial, industrial, and government sectors. At the time of analysis, the latest samples remained completely undetected by antivirus engines on VirusTotal.

Architecture and technical capabilities

According to Group-IB, BraZetsu is a modular platform whose first samples were discovered in early May 2026, although earlier iterations can be traced back to February 2026. In total, five versions of the framework have been identified, each expanding on the functionality of its predecessor. The third generation reportedly narrowed its focus to corporate targets in Brazil.

Key capabilities of the framework include:

• Collecting browsing history from Google Chrome, Microsoft Edge, Brave, Vivaldi and Opera, as well as digital certificates and recently opened files
• Searching for financial files in the CNAB format (a standard for electronic data interchange between companies and banks in Brazil)
• Detecting ERP system installation directories and monitoring active window titles for banking-related keywords
• Executing arbitrary Windows shell commands, capturing screenshots, and enumerating processes and network ports
• Maintaining persistent communication with the management infrastructure via the WebSocket protocol
• Retrieving encrypted C2 server configuration (domain, port, authentication token) from Pastebin

Notably, in the code, logs, and strings related to the server-side component, researchers found signs of generative AI usage — presumably for hardware profiling, data triage, and target prioritization. However, the full extent of AI usage within the attack chain remains unconfirmed.

Infected Marketplace: access as a service

BraZetsu forms the foundation of the Infected Marketplace platform (also known as “Banco de Infects”), which, according to Group-IB, has been operating since February 2026. The initial deposit for buyers is about 5.80 US dollars. The platform allows criminal clients to purchase entry points into victim systems and remotely deploy their own malicious payloads through a specialized interface — without having to establish the initial foothold themselves.

This model creates a threat multiplier effect: a single compromised host can be used by multiple buyers for different purposes — from banking fraud to ransomware deployment. According to the researchers, two compromised hosts from the United States were observed on the marketplace in April 2026, although this isolated observation does not indicate a systematic expansion beyond the region.

Attribution and links to other tools

Group-IB tracks the operators of the framework under the name Exilware and assesses them as Portuguese speakers. The company, with a high degree of confidence, links BraZetsu to the previously known backdoor AgenteV2 — a Python-based tool that targeted Brazilian users via phishing emails masquerading as court summons and streamed the victim’s screen to the attacker in real time when a banking portal was opened. The connection is based on shared codebase, infrastructure, and functionality.

Of particular interest is the overlap with the tool CNABHunter — a Python utility for searching, parsing, and tampering with data in CNAB files. Unlike CNABHunter, BraZetsu does not autonomously modify payment details: its role is limited to reconnaissance and providing initial access. The common element is the list of directories used to search for CNAB files. According to Group-IB, the developers of BraZetsu integrated this functionality shortly after CNABHunter was publicly disclosed by a researcher in May 2026.

The exact delivery mechanism for BraZetsu remains unknown. Researchers discovered a loader masquerading as Microsoft Edge that is downloaded from the domain caixaentradas1inboxshop[.]site. The same domain is associated with VBS files that download subsequent attack stages. Interestingly, the same infrastructure was used, according to Group-IB, to distribute the banking trojan Ousaban. A separate Ousaban campaign targeting Spain and Portugal via phishing PDFs was documented by FortiGuard Labs in May 2026; however, a direct link between this campaign and the operators of BraZetsu has not been independently confirmed.

Impact assessment

The highest risk is faced by organizations in Brazil and on the Iberian Peninsula that work with financial systems, ERP platforms, and bank transfers in the CNAB format. The “access as a service” model means that the compromise of a single system can lead to a cascade of attacks: from theft of financial data to complete takeover of corporate infrastructure. At the same time, the latest versions of the framework retain support for the Spanish language, indicating a strategic positioning for expansion across Latin America.

Security recommendations

• Monitoring WebSocket connections: anomalous outbound WebSocket connections from the corporate network may indicate BraZetsu activity
• Controlling access to Pastebin: the framework retrieves its C2 configuration from Pastebin — blocking or monitoring requests to pastebin[.]com/raw/ can reduce risk
• CNAB file audit: organizations using the CNAB format for banking operations should implement integrity controls for these files and monitor unauthorized access to their storage directories
• Blocking known IOCs: add the domains c2[.]installscenter[.]com, infect[.]online, infectonline[.]store, caixaentradas1inboxshop[.]site and the IP address 38.242.246[.]176 to network filtering rules
• Behavioral analysis: pay attention to processes that enumerate ERP system directories, collect history from multiple browsers simultaneously, and monitor window titles for banking keywords — this is a characteristic behavioral profile of BraZetsu
• Loader inspection: executable files masquerading as Microsoft Edge but downloaded from non-standard sources should be immediately blocked and analyzed

BraZetsu illustrates the maturity of the Brazilian cybercriminal ecosystem: a shift from standalone trojans to a platform-based model in which initial access is systematically monetized via a marketplace. Organizations in the targeted regions should first check their network logs for the listed IOCs, implement WebSocket traffic monitoring, and ensure integrity control for CNAB financial files. The full list of sample hashes and technical indicators is available in the technical report from Group-IB.