Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks

Researchers have identified a new Windows malware called BraZetsu, used to map compromised corporate networks, identify high-value systems, and prepare these accesses for sale to other criminals. The operation focuses primarily on Brazil and other countries in Latin America and the Iberian Peninsula.

The threat has been attributed with high confidence to the Brazilian actor Exilware, which operates as an Initial Access Broker. In this model, the group breaches companies and sells initial access to operators of fraud, data theft, or ransomware.

BraZetsu is developed in Python and uses a modular architecture. After infection, it maintains communication via WebSocket with the command-and-control server and allows remote command execution and screen capture.

The malware searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. It also looks for financial files in the Brazilian CNAB standard, digital certificates, and browser history.

The code shows signs of heavy use of generative AI during development. Internal messages indicate that an AI component on the server may help classify stolen files and prioritize machines considered more valuable. Researchers note that the full extent of AI within the operation has not yet been determined.

BraZetsu contains 27 functions, most dedicated to automatic reconnaissance and information collection. The compromised accesses supply an underground market operated by Exilware. Buyers can acquire infected machines and later deploy their own malware, separating the initial intruder from the final attack against the company.