2026年9月5日の
セキュリティ情報

Subject: [Intel] AI-Driven Access Broker Malware "BraZetsu"

Dear Team,

We are sharing information regarding a new malware framework called BraZetsu.

■ Overview
BraZetsu is a Python-based malware that compromises Windows systems and utilizes generative AI to evaluate the "value" of the victim's machine. These assets are then listed for sale on the "Infected Marketplace" (Banco de Infects). The operation is attributed to the threat actor "Exilware."

■ Scope
- Windows-based systems
- While primarily targeting Latin America and the Iberian Peninsula, the nature of the framework poses a risk to any Windows environment.

■ Recommended Actions
1. Monitor for unauthorized Python process execution on endpoints.
2. Audit network logs for connections to known C2 infrastructure associated with Exilware.
3. Enforce Multi-Factor Authentication (MFA) across all privileged accounts to prevent lateral movement.

■ Reference
- Group-IB Research

Priority: Medium
Deadline: Ongoing

Subject: [Intel] Attack utilizing Radmin/UltraVNC for Proxy Infrastructure

Dear Team,

We are sharing information regarding a recent campaign targeting South Korea that repurposes infected systems as proxy nodes.

■ Overview
Attackers are deploying Radmin and UltraVNC to gain remote control of systems. Once compromised, they install Netch, CCProxy, and SoftEther VPN to transform the infected hosts into proxy or VPN servers for further malicious activities.

■ Scope
- Windows environments where remote administration tools can be installed.

■ Action Items
1. Check network logs for communication with the following IOC:
- 103.86.86[.]244
2. Scan for unauthorized installations of Radmin, UltraVNC, or SoftEther VPN, and check for suspicious paths such as "C:\Intel\RServer".
3. Monitor and restrict PowerShell-based downloads (e.g., via Curl) of executable archives from external sources.

■ Reference
- AhnLab SEcurity intelligence Center (ASEC)

Priority: Medium
Deadline: Immediate review