Executive Summary
Cybersecurity researchers have identified a sophisticated Python-based malware framework known as BraZetsu, operated by a Portuguese-speaking threat group tracked as Exilware. Unlike traditional infostealers, BraZetsu serves as a modular toolkit for Initial Access Brokers (IABs), converting compromised Windows systems into commercial assets sold on the 'Infect Marketplace' (infect[.]online). The group primarily targets Iberian and Latin American organizations across the financial, e-commerce, and industrial sectors.
Technically, the framework is notable for its integration of generative AI to triage exfiltrated data and prioritize high-value targets. BraZetsu demonstrates high operational maturity, utilizing WebSockets for C2 communication and overlapping significantly with CNABHunter, a tool designed to commit financial fraud by manipulating Brazilian banking remittance files. The campaign leverages a multi-stage infection chain involving VBS scripts, steganographic images, and DLL sideloading to maintain stealth.
The emergence of BraZetsu represents a shift toward 'access-as-a-service' models where secondary attackers can purchase and remotely execute payloads on pre-compromised systems. This infrastructure, combined with regional focuses on critical Brazilian financial standards like CNAB, poses a significant threat to corporate payment processes and regional infrastructure stability.