Skip to content
Hunt.io Discovers BraZetsu Access Broker Infrastructure Pre-Disclosure

Hunt.io Discovers BraZetsu Access Broker Infrastructure Pre-Disclosure

First seen 8 Oct 2026, 23:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 9, 2026 at 00:39 UTC
  • •Hunt.io traced BraZetsu's infrastructure, revealing it had shifted months before public disclosure.
  • •BraZetsu is a Python-based access broker targeting Windows systems, linked to the Brazilian actor Exilware.
  • •The tool is sold on the Infected Marketplace, allowing buyers to exploit already compromised machines.

Hunt.io has identified new infrastructure associated with the BraZetsu access broker, which was first detailed by Group-IB on August 31, 2026. This access broker, linked to the Brazilian actor Exilware, utilizes a Python framework to infiltrate Windows machines and target ERP software and other sensitive data. The infrastructure was found to have moved on months before the public disclosure, indicating a proactive approach by the operators. Hunt.io's analysis focused on TLS certificate data, revealing that the command server hostname had been active on a second server since April 4, 2026. The BraZetsu tool is sold on the Infected Marketplace for a deposit of 5.80 Brazilian reais, allowing buyers to access already compromised machines. The findings highlight the challenges of tracking evolving cybercriminal infrastructure.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-08-31
Group-IB publishes BraZetsu details
Group-IB released a report detailing BraZetsu's capabilities and its connection to Exilware.
Securityaffairs.Co
2026-10-08
Hunt.io announces findings
Hunt.io disclosed its findings on BraZetsu's infrastructure, noting its pre-disclosure movement.
hunt.io

More articles in this cluster (2)

Following this threat?

Track BraZetsu in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

What is BraZetsu?
BraZetsu is an access broker tool that compromises Windows machines to gather sensitive data for sale.
How does the BraZetsu tool operate?
It infiltrates systems, checks for ERP software and other sensitive applications, and packages this information for sale.
What should organizations do to protect themselves?
Organizations should monitor their networks for signs of compromise and ensure robust security measures are in place.