#ParsedReport #CompletenessHigh
01-09-2026

Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

https://www.group-ib.com/blog/brazetsu-ai-enhanced-iab-marketplace/

Report completeness: High

Actors/Campaigns:
Exilware (motivation: financially_motivated, cyber_criminal)
Spampower

Threats:
Brazetsu_tool
Cnabhunter
Bancos
Ousaban
Putty_tool
Anydesk_tool
Agentev2
Dead_drop_technique

Victims:
Banking, Enterprise resource planning, Electronic commerce, Industrial control systems, Law enforcement, Government, Cryptocurrency platforms, Healthcare, Insurance brokerage, Logistics, have more...

Industry:
Healthcare, E-commerce, Petroleum, Ics, Telco, Military, Government, Critical_infrastructure, Logistic, Financial

Geo:
Spain, Chile, Brazil, Spanish, Mexico, Brazilian, Argentina, Portugal, Paraguay, Latam, Latin american, Portuguese, United states

TTPs:
Tactics: 6
Technics: 15

IOCs:
Domain: 6
File: 18
IP: 1
Url: 3
Hash: 16

Soft:
Nuitka, Microsoft Edge, Pastebin, Google Chrome, Microsoft Edge, Vivaldi, Opera, PostgreSQL, MySQL, docker, DICOM, have more...

Algorithms:
xor, exhibit, base64

Functions:
get_server_config, _dec, get_active_window_title, check_active_bank_windows, get_browser_intel

Win API:
RUN, copyfile, Popen

Languages:
visual_basic, python, powershell