Affected Systems

Windows systems in Iberian Peninsula and Latin America, particularly Brazil. Targeted sectors include e-commerce, corporate, financial, industrial, and law enforcement. Browsers affected: Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera. Organizations using Brazilian CNAB financial file format at elevated risk.

Exploitation Status

Active exploitation confirmed since February 2026. BraZetsu framework operational since May 2026. Threat actor (Exilware) operates "Infected Marketplace" (infect[.]online) selling compromised access for approximately $5.80 initial deposit. Some samples fully undetected on VirusTotal at time of analysis. Delivery mechanism likely social engineering via phishing.

Business Impact

BraZetsu enables access-as-a-service model where compromised Windows hosts are cataloged and sold to secondary threat actors. Framework performs deep reconnaissance, extracts browser histories, digital certificates, and Brazilian CNAB financial remittance files. Maintains persistent C2 via WebSocket protocol. Buyers can remotely deploy secondary payloads without establishing initial foothold. Creates persistent threat-multiplier effect across regional ecosystem. Related tool CNABHunter rewrites CNAB files to redirect payments to attacker-controlled accounts.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Monitor network traffic for WebSocket connections to known Infected Marketplace infrastructure and domain caixaentradas1inboxshop[.]site
  • Deploy EDR detection rules for Python-based malware masquerading as Microsoft Edge and VBS downloaders from suspicious domains
  • Implement file integrity monitoring for Brazilian CNAB format files and alert on unauthorized access or modification attempts
  • Review browser credential stores and digital certificate access logs for unauthorized extraction activity across Chrome, Edge, Brave, Vivaldi, and Opera
  • Conduct threat hunting for indicators of BraZetsu and CNABHunter using Group-IB technical report IOCs, focusing on Portuguese-language social engineering lures targeting Latin American organizations