Group-IB (31 August 2026) attributes BraZetsu, a modular Python-based Windows malware framework, with high confidence to the Brazilian threat actor Exilware. Unlike a standard infostealer, Group-IB describes it as a master toolkit for initial access brokers that powers an AI-enhanced underground marketplace commercialising compromised Iberian and Latin American targets in corporate, financial, industrial, law-enforcement and other environments; its modular architecture and stealth let some samples remain fully undetectable on VirusTotal at the time of analysis.

Defenders in those regions should hunt for the BraZetsu behaviours in Group-IB's write-up, restrict script interpreters where policy allows, and treat brokered access listings as post-compromise inventory rather than the root cause. (source: Group-IB)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: Group-IB)