BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory

Incident note — 3 September 2026

On 3 September 2026, Group-IB disclosed BraZetsu, a Python-based Windows malware framework attributed with high confidence to the Brazilian threat actor known as Exilware. It functions as the primary technical mechanism for an Initial Access Broker (IAB) operation that commercialises footholds through an underground marketplace referred to as the 'Infect Marketplace'.

The operation feeds compromised hosts — primarily in Iberian and Latin American environments — into a catalogue that buyers can purchase for subsequent intrusion activity. Group-IB highlights the AI-enhanced framing of the campaign, as well as BraZetsu's modular structure and stealth characteristics, which left some samples undetectable on VirusTotal at the time of analysis.

The direct impact on Australian entities is assessed as low, though the broader supply-chain and credential-resale risk warrants attention given the reach into Spanish- and Portuguese-language regions where Australian businesses may operate.