ExilwareThreat actor
Exilware is a Brazilian threat actor operating the "Infect Marketplace," which commercializes access to compromised systems using the BraZetsu malware framework. BraZetsu employs a modular architecture and AI-driven reconnaissance to optimize target value across various sectors, including banking and government systems.From MISP Galaxy
Last reported 16 days ago, by Security Affairs4 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1010Application Window Discovery
“T1010”
- T1012Query Registry
“T1012”
- T1016System Network Configuration Discovery
“T1016”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“T1027.002”
- T1046Network Service Discovery
“T1046”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure“…ailed writeup on BraZetsu back on August 31, naming it a Python framework compiled with Nuitka and tying it to a Brazilian actor called Exilware with high confidence.”
-
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino“…k de malware para Windows basado en Python que atribuimos, con un alto grado de confianza, al actor de amenazas brasileño conocido como Exilware.”
-
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates“…urity researchers have identified BraZetsu, a new Python-based Windows malware framework developed by a Brazilian threat actor known as Exilware and used as a tool for initial access operations across LATAM.”
-
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem“… a sophisticated Python-based Windows malware framework that we attribute, with high confidence, to the Brazilian threat actor known as Exilware.”
Indicators in its reports
named in the reports above- c2.installscenter[.]comin 3 reports
- installscenter[.]comin 3 reports
- caixaentradas1inboxshop[.]sitein 2 reports
- caixaentradas1boxshop[.]sitein 2 reports
- infect[.]onlinein 2 reports
- 38.242.246[.]176in 2 reports
- hxxps://pastebin[.]com/raw/aF0WCxiain 2 reports
- hxxps://pastebin[.]com/raw/hM0nXNBPin 2 reports
- hxxps://pastebin[.]com/raw/9ChwVzzwin 2 reports
- infectonline[.]storein 2 reports
- f775fe06a4c2563c…cee7972e6b17in 2 reports
- 54e313434a7f3fa3…cdd9fabf2700in 2 reports
- 91f225dcc7a01f92…02ce638fa6b0in 2 reports
- cd8fc8effea20d28…41d51b6f6c78in 2 reports
- d881a60ccd03b541…65843643af99in 2 reports
- 0fa785bb9f95b113…2d85746fc5bfin 2 reports
- 1510823e7c80b4db…2e1c5cf30246in 2 reports
- 96960409b6e1abf2…d5aa56579042in 2 reports
- 0cd0cc49ea4ff48c…7f70bb6c0d5din 2 reports
- 30af2ec2437af0f4…a7a781c1e2fein 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.