Group-IB analysts Julio Guapo Menezes and Miguel Salazar documented BraZetsu, a Python malware framework for Windows first seen in the wild in early May 2026. The actor, Exilware, was first identified on 2 February 2026.

What makes it worth reading is not the capability list. It is what the capability list is for.

The reconnaissance is a product listing

BraZetsu profiles a compromised host across hardware, installed software, network ports and running processes. Then it collects the things that are not about the machine at all:

  • Browser history from Chrome, Edge, Brave, Vivaldi and Opera
  • Digital certificates
  • Recently opened files
  • The location of ERP directories
  • Banking keywords appearing in active application window titles
  • Screen captures

Read that as an intake form rather than a theft. ERP directory present? This is a business, not a home PC. Banking keywords in the window title? Somebody here moves money. Certificates? Things can be signed. History from 5 browsers? Here is what this person has access to. Each field maps to a price, and the framework exists to fill them in.

The price is $5.80

The profile feeds the Infected Marketplace, also called Banco de Infects, at infect[.]online, and initial access to a compromised host costs around $5.80. It is not a ransom and it is not a wire transfer — it is the wholesale cost of standing inside a company, and every downstream incident that begins "initial access was obtained by an unknown means" has a price like that at the front of it.

Buyers can execute further payloads on what they have bought, which Group-IB describes as a threat-multiplier effect: one compromise, resold, becomes whatever the buyer already had planned. Renting compromised routers as residential proxies runs on the same economics.

Where the AI actually is

This will be reported as AI-powered malware. That framing is wrong in a specific and interesting way.

Group-IB describes generative AI used for malware development, and then for backend data triage and target prioritisation — automatically evaluating a compromised machine's commercial potential.

The model is not in the payload. It is in the back office, doing inventory management: reading profiles, sorting them, and deciding what is worth listing at $5.80 and what is not. A far more mundane use of the technology, and a far more durable one, because it scales the part of the business that used to need a person reading each victim one at a time.

We wrote this week that three labs shipped cyber models and graded their own homework. This is the other end of the same market: no frontier capability required, just enough automation to price stock.

Delivery and evasion

The loader masquerades as Microsoft Edge and comes from caixaentradas1inboxshop[.]site, with VBScript files pulling later stages. Group-IB says social engineering is the most likely delivery route.

Persistence and control run over WebSocket straight to the marketplace, with C2 details pulled from Pastebin URLs. Some samples were fully undetected on VirusTotal at the time of analysis.

Five distinct versions have appeared since 9 February 2026. The third generation narrowed to Brazilian corporate targets, though access to two US-based hosts was advertised at the same time.

Targeting spans Iberian and Latin American e-commerce, corporate, financial, industrial and law enforcement organisations. The malware specifically hunts Brazilian CNAB remittance files, the fixed-width format used for financial data interchange.

On the attribution

Group-IB assesses with high confidence that BraZetsu and the earlier AgenteV2 backdoor are the same framework, on shared codebase, infrastructure and capability — with the C2 address 38.242.246[.]176 appearing in both.

The operators are described as believed to be native Portuguese speakers. That is a language assessment, not an identification, and it should not be read as more.

What to do

  • Alert on ERP directory enumeration by non-administrative processes. Profiling that specific is not something normal software does.
  • Watch for outbound WebSocket to non-business destinations, and for Pastebin fetches from servers.
  • Treat "initial access by unknown means" as purchasable. When you reconstruct an intrusion, the entry point may have been bought rather than earned, which changes what you look for in the weeks before.
  • Undetected on VirusTotal is the normal case, not the alarming one. Detection-by-hash was never going to catch a framework at five versions in seven months.

What is not established

  • How many hosts are listed on the marketplace, or how many have sold.
  • Which generative model or service is being used, or whether the AI claims are anything more than the researchers' inference from artefacts.
  • Who Exilware is. Language is not identity.
  • Whether the two advertised US hosts indicate a shift in targeting or an opportunistic listing.
  • The full delivery chain. Social engineering is described as most likely, not confirmed.