Executive Summary
BraZetsu is a Python-based framework, attributed with high confidence to the Brazilian threat actor Exilware, functioning as an Initial Access Broker (IAB) platform. The actor operates a marketplace called "Banco de Infects" where compromised Windows host access is sold for approximately $5.80. Recent analysis by Hunt.io has identified a migration of infrastructure from Contabo VPS to Njalla privacy-focused hosting, revealing a persistent pattern of control panels and C2 nodes sharing identical apex domains.
The attack chain involves the delivery of binaries compiled with Nuitka, which perform extensive enumeration of ERP and SCADA systems. While the C2 domains often move behind Cloudflare, the underlying origin infrastructure remains detectable through unique TLS certificate common names and non-standard administration ports. This threat primarily impacts Latin America and the Iberian Peninsula, specifically targeting financial and industrial sectors within Brazil.