Hackers Use AI Malware to Rank and Sell Access to Compromised Corporate Networks

Hackers are using a new Windows malware framework to turn corporate break-ins into products for sale. The tool, called BraZetsu, quietly maps a victim’s systems, finds valuable business data and helps criminals decide which footholds deserve the highest price.

The campaign is aimed mainly at organizations in Brazil and elsewhere in Iberia and Latin America.

It appears to arrive through social engineering, with files disguised as routine software or notices, before creating a channel that lets operators explore a compromised machine and deploy further payloads.

Analysts at Group-IB identified the malware and linked it with high confidence to a Brazilian actor tracked as Exilware.

Group-IB said in a report shared with Cyber Security News (CSN) that the operation developed from a basic remote-access tool into a framework built to support access brokers.

The threat goes beyond information theft. Criminals collect the details needed to package an infected company for buyers, creating a supply chain that can support fraud, data theft or ransomware. It reflects how access brokers fuel ransomware operations.

Hackers Use AI Malware

BraZetsu is written in Python and compiled into Windows executables, a choice that can make ordinary signature checks less effective.

Group-IB found that recent samples used a modular design, hid console activity and maintained an interactive WebSocket connection with command-and-control infrastructure.

Its standout feature is reconnaissance. The malware inventories the device, running programs, network ports and software linked to business functions.

It also searches browser history and financial remittance files, including Brazil’s CNAB format, while looking for digital certificates and signs of enterprise resource-planning, industrial-control, development, backup and security environments.

The code contains 27 functions, most focused on finding and describing valuable systems. It can capture screenshots and run commands remotely, giving an operator both automated results and the option of hands-on control.

This is the same broad risk behind AI built malware operations, where machine-assisted tooling can speed decisions after entry. Group-IB said verbose logs and emoji-heavy messages point to extensive use of generative AI during development.

More importantly, embedded strings indicate that a server-side AI component may process stolen information, judge whether a file is a priority and assess hardware and machine details. The researchers could not determine the full extent of AI use across the attack lifecycle.

This approach changes the economics of intrusion. Rather than manually checking every infected computer, the operation can label systems by their likely value and sell better-prepared access. It also helps explain why defenders should treat unusual discovery activity as seriously as an attempted data theft.

Marketplace Expands the Risk

Exilware has operated an underground service since February 2026, selling compromised hosts through its Infect Marketplace. Group-IB assesses that BraZetsu is the primary engine replenishing that inventory.

Buyers can acquire access and remotely launch their own secondary malware, separating the initial breach from the eventual attack.

The reported entry cost was about $5.80, which lowers the barrier for criminals to participate. The operators later restricted accounts, requiring customers to spend deposited funds within 24 hours on busy days or 49 hours on normal days.

Two United States hosts advertised in April suggest possible expansion beyond the operation’s usual regional focus, although that evidence alone does not prove a lasting change.

For defenders, that model means an infection may be only the opening stage. A company could first be profiled, then resold to a buyer with a different goal.

The pattern resembles brokered network access sales, which give ransomware crews and other actors a ready-made route into corporate environments.

Organizations should enable strong logging and monitoring on endpoints tied to finance and business-management systems, then segment critical assets to limit movement after a compromise.

Teams should investigate registry queries, software enumeration and searches for .cnab, .240, .400, .pfx and .p12 files, as well as suspicious WebSocket traffic to unfamiliar destinations.

They should also block or tightly control Pastebin and similar services when not needed, because BraZetsu uses them to retrieve encrypted configuration data.

Staff should verify unexpected software and notification files before opening them. Such caution remains important as phishing enabled remote access continues to give intruders a foothold.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Use AI Malware to Rank and Sell Access to Compromised Corporate Networks appeared first on Cyber Security News.