BraZetsu est un framework malveillant Python, compilé avec Nuitka, attribué à Exilware. Group-IB établit avec haute confiance que BraZetsu et AgenteV2 sont le même framework.
BraZetsu
BraZetsu is a Python-based Windows backdoor and initial-access-broker framework attributed with high confidence to the Brazilian cybercriminal actor Exilware.
Profile source: Mallory opens in a new tabBraZetsu
Family profile
BraZetsu is a Python-based Windows backdoor and initial-access-broker framework attributed with high confidence to the Brazilian cybercriminal actor Exilware. Compiled into native Windows executables, it establishes persistent access and profiles compromised hosts for resale through Exilware's Infected Marketplace. BraZetsu performs extensive system, process, software, network-service, active-window, browser-history, and business-environment reconnaissance, with particular interest in banking, ERP, e-commerce, industrial/SCADA, security, backup, healthcare, logistics, and law-enforcement environments. It collects Chromium-browser history, Brazilian CNAB financial-remittance files, and digital certificates; captures screenshots; executes remote shell commands; and can deploy additional worker modules. It uses encrypted dead-drop configuration retrieval and persistent WebSocket-over-TLS command-and-control communications. Later variants emphasized Brazilian corporate ERP and financial environments. Activity has primarily affected Brazil and broader Iberian and Latin American organizations. BraZetsu is assessed to be the same framework as AgenteV2.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Initial Access
- Persistence
- Post Exploitation
- Reconnaissance
- Scanning
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
BraZetsu in ATT&CK
33 distinct techniquesTechniques
33 techniques T1012 Query Registry T1204.002 Malicious File T1113 Screen Capture T1547.001 Registry Run Keys / Startup Folder T1059.001 PowerShell T1059.003 Windows Command Shell T1027.002 Software Packing T1518 Software Discovery T1564.003 Hidden Window T1041 Exfiltration Over C2 Channel T1005 Data from Local System T1083 File and Directory Discovery T1057 Process Discovery T1102 Web Service T1059 Command and Scripting Interpreter T1082 System Information Discovery T1049 System Network Connections Discovery T1217 Browser Information Discovery T1036 Masquerading T1566 Phishing T1010 Application Window Discovery T1059.005 Visual Basic T1071.001 Web Protocols T1649 Steal or Forge Authentication Certificates T1119 Automated Collection T1046 Network Service Discovery T1105 Ingress Tool Transfer T1027 Obfuscated Files or Information T1036.005 Match Legitimate Resource Name or Location T1016 System Network Configuration Discovery T1102.001 Dead Drop Resolver T1552.004 Private Keys T1573 Encrypted Channel
