Bra Zetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
Summary: Group-IB disclosed BraZetsu, a modular Python-based Windows malware framework built by a Portuguese-speaking actor tracked as Exilware, which turns compromised hosts into inventory for the Infected Marketplace, an access-as-a-service platform selling initial access for a deposit of roughly $5.80. Five versions have been detected since the earliest iteration on February 9, 2026, and the framework uses AI for malware development, backend data triage, and target prioritization, with some samples fully undetectable on VirusTotal at the time of analysis.
What's compelling: A criminal marketplace that prices access based on automated assessment of each victim's hardware, software, and network value - and lets buyers run their own payloads on purchased hosts - turns every foothold into a resalable asset, with the actor already advertising two compromised U.S. hosts alongside its Brazilian targets.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026