Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks
Researchers have identified a new Windows malware called BraZetsu, used to map compromised corporate networks, identify high-value systems, and prepare these accesses for sale to other criminals. The operation focuses primarily on Brazil and other countries in Latin America and the Iberian Peninsula.
The threat has been attributed with high confidence to the Brazilian actor Exilware, which operates as an Initial Access Broker. In this model, the group breaches companies and sells initial access to operators of fraud, data theft, or ransomware.
BraZetsu is developed in Python and uses a modular architecture. After infection, it maintains communication via WebSocket with the command-and-control server and allows remote command execution and screen capture.
The malware searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. It also looks for financial files in the Brazilian CNAB standard, digital certificates, and browser history.
The code shows signs of heavy use of generative AI during development. Internal messages indicate that an AI component on the server may help classify stolen files and prioritize machines considered more valuable. Researchers note that the full extent of AI within the operation has not yet been determined.
BraZetsu contains 27 functions, most dedicated to automatic reconnaissance and information collection. The compromised accesses supply an underground market operated by Exilware. Buyers can acquire infected machines and later deploy their own malware, separating the initial intruder from the final attack against the company.
Related articles
Callfuscated: Reverse Engineering a Stack-Based VM Protected by MBA, Opaque Predicates and Call-Based Jumps
A detailed technical write-up examines the HackTheBox challenge Callfuscated, which combines virtualization, mixed Boolean-arithmetic expressions, opaque predicates and junk instructions. The author first converts call-pop sequences into direct jumps by proving that register r8 is never read, then removes the resulting NOPs to obtain clean code. The resulting binary reveals a classic stack-based virtual machine whose handlers invoke heavily obfuscated functions. Triton is used to lift these functions into AST form, after which the CoBRA solver simplifies the MBA expressions into the original operations: addition, subtraction, multiplication, XOR, OR and AND. With semantics recovered, the author captures the bytecode at runtime, writes a C translator that emits readable operations, compiles the output and obtains a clean decompiled routine that checks the flag.
Backblaze Responds in Minutes While reg.ru Delays Action on Banking Trojan Infrastructure
A detailed reverse-engineering report reveals a sophisticated Android banking Trojan distributed via Telegram spam that disables antivirus apps, intercepts SMS one-time codes, and exfiltrates banking credentials. The malware uses AES-encrypted assets, a custom binary protocol over sockets, and multiple modules for screen streaming, keylogging, microphone access, and remote control. Infrastructure analysis traced the payload to an S3-compatible bucket on Backblaze, four command-and-control domains, and a VPS, with the domains registered through reg.ru. Notifications sent to Backblaze resulted in account termination within 11 minutes, while reg.ru responded only after a week with a statement refusing action without a court order. The same signing certificate appears across multiple variants, allowing rapid infrastructure rotation that keeps the campaign active despite takedown attempts. Kaspersky and CERT teams were also notified but produced no visible results within the observed period.
SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a passive Windows backdoor that stays dormant in memory until it receives one specially crafted encrypted network packet. Upon activation the implant decrypts and executes custom bytecode written in a proprietary 23-instruction language, eliminating traditional beaconing and reducing network indicators. The malware is delivered as a 64-bit DLL that impersonates dpapi.dll and is loaded via DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous and NullSessionPipes. Configuration is protected with AES-256-CCM and the sample contains no confirmed victims or attributed infrastructure. Researchers have released YARA rules and read-only scanning utilities to detect the implant and its artifacts.
SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet
SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.