Timing is what undercuts the standard response here. Group-IB's report describes a sequence with a sale in the middle of it: infect, enumerate, score, list, sell, then run the buyer's code [1][10]. Credential rotation only closes the first step in that chain, leaving the listing itself unaffected.
BraZetsu does the scoring before a broker sets a price. It performs deep reconnaissance and scans the network around the host, pulls browser history from Chrome, Edge, Brave, Vivaldi and Opera, takes screen captures, and collects digital certificates [19][11]. Group-IB attributes the back-end triage and target prioritisation to generative AI, which the analysts say the crew also used for development [6]. The product a buyer collects is therefore a pre-sorted entry point rather than an unlabelled shell, and the marketplace carries a feature to execute payloads remotely on purchased access without the buyer establishing a foothold at all [10]. Persistence to the platform runs over WebSocket [13].
Entry to the Infected Marketplace, also advertised as Banco de Infects and infect[.]online, takes an initial deposit of roughly $5.80 [7]. Exilware was first discovered on 2 February 2026 operating what Group-IB characterises as a basic remote access trojan; the modular Python framework was first seen in early May 2026 [8][9]. That is about three months from RAT to AI-assisted intelligence framework [17], and the marketplace is the thing the framework was rebuilt to feed.
The CNAB detail is where the two revenue models separate. BraZetsu hunts for corporate remittance files in the Brazilian Federation of Banks' fixed-width CNAB format, the standard used for payment interchange between companies and banks [12]. CNABHunter, which Group-IB says overlaps with BraZetsu, goes further: it parses those records, exfiltrates payment metadata, polls a server for operator orders, and on instruction rewrites the files to substitute attacker-controlled bank details, PIX keys or barcodes [14][15]. Group-IB places BraZetsu on the access side rather than the fraud side [16]. Read CNABHunter as the catalogue of what a buyer may do after purchase.
The evidence comes with two caveats worth flagging. This is one vendor's report, and the Portuguese-speaking attribution for Exilware is an assessment, not a claim of identity [4]. The observation that some samples were fully undetectable on VirusTotal is dated to the time of analysis, so it describes a snapshot of detection coverage rather than a permanent property of the samples [3].
For anyone inside the e-commerce, corporate, financial, industrial or law enforcement scope Group-IB names across Iberia and Latin America [5], a stealer ticket closed on password resets leaves the sellable part of the compromise intact. That is the argument for rebuilding the host and hunting laterally from it.
