Exilware

Exilware is a financially motivated Brazilian cybercriminal actor operating an initial-access-broker business. Since February 2026, it has operated Infect Marketplace, also known as Infected Marketplace or Banco de Infects, selling access to compromised Windows systems and enabling buyers to execute their own tools and secondary malware. Its activity primarily focuses on Brazilian corporate environments, with additional targeting in Latin America and Spain. Targeted environments include financial organizations, e-commerce businesses, industrial enterprises, government and law-enforcement entities, healthcare organizations, and technology and communications providers. The marketplace has also advertised access to compromised hosts in the United States. Exilware's primary malware framework is BraZetsu, a modular Python-based Windows framework compiled with Nuitka. BraZetsu and the AgenteV2 backdoor have been assessed with high confidence to represent the same framework. Five versions appeared between February and May 2026, evolving from basic remote access into an extensive reconnaissance and access-brokering platform. The malware inventories systems, processes, installed applications, network services, browser histories, and enterprise software to identify commercially valuable hosts. It searches for banking activity, Brazilian CNAB financial-remittance files, digital certificates, ERP installations, industrial-control software, cloud tooling, backup products, and endpoint-security products. Collected certificates and victim dossiers are exfiltrated to support access sales. BraZetsu supports arbitrary shell-command execution, screenshot capture, and deployment of supplementary payloads. Early versions established persistence through a Windows Registry Run key. Defense-evasion measures include concealed console activity, software masquerading, and compiled Python executables. The framework retrieves encoded and XOR-encrypted command-and-control configuration through Pastebin dead drops and maintains interactive WebSocket communications over TLS, allowing operators to change infrastructure without rebuilding the malware. The exact initial infection mechanism remains unknown, although associated delivery infrastructure has hosted software-masquerading loaders and staged Visual Basic Script downloaders. Exilware's established business model centers on reconnaissance and monetizing compromised access rather than direct ransomware deployment or automated payment manipulation.