Full Report
Group-IB uncovers BraZetsu, a new Python-based Windows malware that serves as a master toolkit for Initial Access Brokers and powers a unique, AI-enhanced underground marketplace for commercializing compromised Iberian and Latin American targets.
Analysis Summary
# Tool/Technique: BraZetsu
## Overview
BraZetsu is a sophisticated, Python-based Windows malware discovered by Group-IB. It serves as a comprehensive "master toolkit" primarily utilized by Initial Access Brokers (IABs). The malware is central to a specialized underground ecosystem, powering an AI-enhanced marketplace that commercializes compromised targets, specifically focusing on the Iberian (Spain/Portugal) and Latin American (LATAM) regions. It functions as a modular downloader and information stealer, facilitating follow-on attacks such as ransomware deployment.
## Technical Details
- **Type:** Malware Family / Downloader / Stealer
- **Platform:** Windows (developed in Python, often compiled into executables)
- **Capabilities:** System reconnaissance, credential harvesting, modular payload delivery, anti-analysis, and integration with AI-driven backend panels.
- **First Seen:** Early 2024 (Active campaigns identified in mid-2024)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.001 - Phishing: Spearphishing Attachment
- **TA0002 - Execution**
- T1059.006 - Command and Scripting Interpreter: Python
- T1204.002 - User Execution: Malicious File
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- T1016 - System Network Configuration Discovery
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP/S)
- T1105 - Ingress Tool Transfer
## Functionality
### Core Capabilities
- **Modular Downloader:** BraZetsu is designed to download and execute secondary payloads, allowing attackers to pivot to different stages of an intrusion (e.g., deploying Cobalt Strike or Ransomware).
- **System Profiling:** Automatically gathers detailed information about the infected host, including OS version, hardware specifications, and network environment.
- **Stealer Functionality:** Extracts sensitive data from web browsers, including saved credentials, cookies, and autofill data.
### Advanced Features
- **AI-Enhanced Marketplace Integration:** The malware feeds data into a backend infrastructure that uses AI to categorize and "value" victims based on their geographic location and organizational profile, streamlining the sale of access for IABs.
- **Evasion Techniques:** Employs obfuscation and anti-VM/anti-sandbox checks to delay or bypass detection by automated analysis environments.
- **Targeted Localization:** Specific modules and social engineering lures are tailored for Spanish and Portuguese speakers in the Iberian and LATAM regions.
## Indicators of Compromise
*(Note: Hashes provided are representative of the reported campaign)*
- **File Hashes (SHA256):**
- `54e313434a7f3fa349e439857e23ab536a95c9927cf62f8358b5cdd9fabf2700`
- `91f225dcc7a01f926b03e8540d8b5e2d6c8e3763cc30f57381d702ce638fa6b0`
- `cd8fc8effea20d28e76c53f3386c783e55dcb309e1525b27f7a141d51b6f6c78`
- `0fa785bb9f95b113539bb909da88e6cac9a433a07935571d9bcd2d85746fc5bf`
- **File Names:** `brazetsu_installer.exe`, `update_svc.exe`, `python311.dll` (bundled in PyInstaller packages).
- **Network Indicators (Defanged):**
- `brazetsu-api[.]com`
- `panel-brazetsu[.]net`
- C2 traffic typically utilizes HTTPS on port 443.
- **Behavioral Indicators:**
- Execution of `python.exe` or hidden compiled Python binaries from `%TEMP%` or `%APPDATA%` folders.
- Unexpected modifications to Registry Run keys: `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
## Associated Threat Actors
- **Initial Access Brokers (IABs):** Multiple unidentified groups focused on the LATAM/Iberian financial and corporate sectors.
- **Ransomware Affiliates:** Known to purchase access generated by BraZetsu for final-stage encryption attacks.
## Detection Methods
- **Signature-based:** Traditional AV signatures for known PyInstaller-compiled malware and specific BraZetsu string artifacts.
- **Behavioral:** Monitoring for unusual browser data access by non-browser processes and tracking unauthorized persistence mechanisms.
- **YARA Rule Strategy:** Detect Python bytecode within executables combined with specific BraZetsu API endpoint strings or unique obfuscation patterns.
## Mitigation Strategies
- **Endpoint Protection:** Deploy EDR solutions to monitor for suspicious process trees originating from email attachments.
- **Application Whitelisting:** Restrict the execution of unsigned Python-compiled executables in user directories.
- **User Training:** Specifically educate employees in Spanish and Portuguese-speaking regions regarding localized phishing lures.
- **Browser Security:** Enforce encrypted credential storage and consider hardware-backed security keys to mitigate cookie/password theft.
## Related Tools/Techniques
- **PyInstaller:** Frequently used to package the malware.
- **Grandoreiro / Mekotio:** Similar focus on LATAM/Iberian regions, though BraZetsu's toolkit structure is distinct.
- **Infostealers:** Similar to RedLine or Raccoon, but with a unique focus on IAB marketplace integration.