01Group-IB · Oct 2BraZetsu implant feeds Exilware's Infected Marketplace with Windows access
Group-IB's Oct 2 report attributes BraZetsu to the Brazilian actor Exilware with high confidence (its wording). It is a Python 3 Windows framework compiled with Nuitka; Group-IB tracks five versions back to Feb 2026 and says the latest was undetected on VirusTotal at time of writing. It feeds the 'Infected Marketplace' where access is sold, with victims in corporate, financial, industrial and law-enforcement entities in Iberia and Latin America. It collects Brazilian CNAB financial files, Chromium browsing history and .PFX/.P12 certificates. Initial vector is unknown; a distribution domain served msdege*.exe, wifi_driver.exe and Portuguese court-notice VBS files overlapping Ousaban. Group-IB says the link to CNABHunter is unknown. Developers are assessed, with moderate confidence, as native Portuguese speakers. My read covered the Spanish edition only; persistence and marketplace sections were not reviewed.
Technique map (IDs checked at attack.mitre.org). T1217 Browser Information Discovery: SQLite query of browser history against ~230 target domains; telemetry DeviceFileEvents; sketch: DeviceFileEvents | where FileName =~ 'History' and FolderPath has_any ('Chrome','Edge') and InitiatingProcessFileName !in~ ('chrome.exe','msedge.exe') | summarize by DeviceName, InitiatingProcessFileName. T1518.001 Security Software Discovery: process checks for csfalconservice.exe, sentinelagent.exe, msmpeng.exe, plus ERP names (sap, totvs, protheus, diebold); telemetry DeviceProcessEvents; SPL: index=edr parent_process_name="python*.exe" | stats count by host, process_name. T1071.001 Web Protocols (nearest fit for WebSocket C2; Pastebin fetch of an XOR-encoded config, then c2[.]installscenter[.]com): DeviceNetworkEvents | where RemoteUrl has_any ('pastebin.com','installscenter.com') and InitiatingProcessFileName !in~ ('chrome.exe','msedge.exe','firefox.exe'). T1005 Data from Local System: CNAB and OneDrive .PFX/.P12 reads. T1113 Screen Capture and T1059.003 Windows Command Shell (cmd.exe commands). These are sketches to adapt and test, not validated rules.
For your stack: query Defender DeviceNetworkEvents for non-browser processes reaching Pastebin or installscenter[.]com and DeviceFileEvents for non-browser reads of Chromium History, then block the listed domains.
02Arctic Wolf · Sep 24ClickFix lure runs msiexec from Win+R to install Psychedelic Stealer
Arctic Wolf Labs reported the campaign Sep 24; this write-up uses the Securonix repost of Sep 30. It is not attributed to a named actor; operator artifacts are Russian-language and targets were Ukrainian small businesses, so it is not finance-specific and is included as an access-enabling technique. Activity ran Sep 9–14: at least 6 compromised sites, 557 views, 426 clicks, 79 completions. A fake Cloudflare page copies an Msiexec /i command with a remote .msi and an ORG_NOTE= property for the victim to paste into Win+R. The payload installs a scheduled task and a browser extension with a native-messaging host. Arctic Wolf's guidance had a truncated invalid IP that Securonix corrected.
Technique map (IDs verified). T1204.002 User Execution: Malicious File; T1218.007 System Binary Proxy Execution: Msiexec; T1053.005 Scheduled Task/Job: Scheduled Task (task psychedelicloveUtils, logon trigger); T1176 Software Extensions; T1555.003 Credentials from Password Stores: Credentials from Web Browsers. Telemetry: DeviceProcessEvents, DeviceRegistryEvents (RunMRU), DeviceNetworkEvents. Sketch (KQL): DeviceProcessEvents | where FileName =~ 'msiexec.exe' and ProcessCommandLine matches regex @'(?i)/i\s+"?https?://' and InitiatingProcessFileName =~ 'explorer.exe'. SPL: index=edr process_name=msiexec.exe parent_process_name=explorer.exe process_command_line="*http*" | stats count by host, process_command_line. Check SigmaHQ for an existing msiexec-with-URL rule before writing your own; I did not access SigmaHQ.
For your stack: run the msiexec-from-explorer query over 30 days of DeviceProcessEvents and consider restricting the Win+R Run dialog on finance endpoints.
03Microsoft · Sep 22EvilTokens device-code phishing hit financial services among 10,000+ organizations
Outside the seven-day window but within 30 days: Microsoft Threat Intelligence's Sep 22 report on EvilTokens, tracked as Storm-2992 (the page also contains a Storm-2922 typo). The phishing-as-a-service platform appeared in Feb 2026 and, per Microsoft, compromised more than 12,000 inboxes across over 10,000 organizations, with financial services among affected industries and AI-assisted lures. Microsoft's Digital Crimes Unit coordinated a disruption. Microsoft lists the service price as $1,500 plus $500 a month. Victims authorize an attacker-initiated OAuth device-code flow, handing over tokens, then inbox rules, device registration and Graph recon follow.
Technique map (IDs verified). T1528 Steal Application Access Token (device-code token theft; no cleaner technique found); T1078.004 Valid Accounts: Cloud Accounts; T1114.003 Email Collection: Email Forwarding Rule (closest fit for malicious inbox rules). Telemetry: Entra SigninLogs / AADNonInteractiveUserSignInLogs, OfficeActivity. Sketch (KQL, Sentinel): SigninLogs | where AuthenticationProtocol =~ 'deviceCode' | summarize count() by UserPrincipalName, IPAddress, AppDisplayName. Microsoft publishes Defender detections and hunting queries; use those over this sketch.
For your stack: query SigninLogs for deviceCode authentications and, if no business need exists, block device code flow with a Conditional Access policy, as Microsoft recommends.
04CISA · Oct 4CISA adds Citrix NetScaler CVE-2026-88779 to KEV; due date Oct 7
CISA added CVE-2026-88779, a memory-buffer flaw in NetScaler ADC and Gateway configured as a SAML SP or IdP, to KEV on Oct 4. Citrix rates it CVSS 8.7 and reports targeted attacks causing denial of service (per Sophos). SecurityWeek reports a federal due date of Oct 7 and that it is the sixth NetScaler flaw in KEV in 2026; watchTowr told SecurityWeek it reproduced it as a crash-only bug and suspects crashes were used to speed exploitation of CVE-2026-88771. Reddit admin reports relayed by SecurityWeek describe shell commands in the username field and a script that tries to plant web shells; that is unverified secondhand. I found no IAB attribution, so this is an edge-device signal for finance perimeters, not an IAB campaign.
Technique map: Exploit Public-Facing Application was not opened at attack.mitre.org this run, so no ID is asserted. Telemetry: NetScaler authentication and syslog forwarded to Splunk. Sketch (SPL): index=netscaler "SAML" ("$(" OR "|sh" OR "curl " OR "wget ") | stats count by src_ip, user. Adapt to your log format and test.
For your stack: patch NetScaler SAML appliances now, then search forwarded authentication logs for shell metacharacters in username fields and unexpected reboots since Oct 2.
05Indicators · Oct 2Sentinel watchlist CSV: BraZetsu and Psychedelic Stealer indicators
Header: type,value,context,first_seen,source,confidence,flag. Network values are defanged; strip [.] and swap hxxps for https before import. Hashes as published. Confidence is my assessment (not stated by the sources).
domain,c2[.]installscenter[.]com,BraZetsu WebSocket C2,2026-10-02,OTX pulse via OffSeq / Group-IB,medium,
domain,installscenter[.]com,BraZetsu infrastructure,2026-10-02,OTX pulse via OffSeq,medium,
domain,caixaentradas1inboxshop[.]site,BraZetsu distribution (msdege*.exe / wifi_driver.exe),2026-10-02,Group-IB / OTX pulse,medium,possibly stale
domain,caixaentradas1boxshop[.]site,BraZetsu related distribution,2026-10-02,OTX pulse via OffSeq,low,possibly stale
domain,infect[.]online,Infected Marketplace,2026-10-02,OTX pulse via OffSeq,medium,
domain,infectonline[.]store,Infected Marketplace related,2026-10-02,OTX pulse via OffSeq,low,
sha256,0cd0cc49ea4ff48c675368f725e183608494f22fefa92d2f33577f70bb6c0d5d,BraZetsu sample,2026-10-02,OTX pulse via OffSeq,medium,
sha1,20491e200ac6a524d5e33cdabc0ece1376dcde2f,BraZetsu sample (public detonation report cited by Group-IB),2026-10-02,Group-IB / OTX pulse,medium,
md5,0e00adb0a5ca285b838af623c753b6ff,BraZetsu sample,2026-10-02,OTX pulse via OffSeq,medium,
url,hxxps://uasputnik[.]com/elita.msi,Psychedelic Stealer MSI payload (domain registered 2026-09-09),2026-09-24,Arctic Wolf via Securonix,high,stale: disposable infra
domain,fsputnik[.]com,Psychedelic Stealer infrastructure,2026-09-24,Arctic Wolf via Securonix,medium,stale: disposable infra
ip,193.178.159[.]128,Psychedelic Stealer C2 port 8080 (corrected by Securonix),2026-09-24,Arctic Wolf via Securonix,high,stale: disposable infra
ip,107.175.82[.]242,Psychedelic Stealer payload host port 9000,2026-09-24,Arctic Wolf via Securonix,medium,stale: disposable infra
ip,176.53.159[.]40,Psychedelic Stealer lure host (AS154383 ZORNTECH),2026-09-24,Arctic Wolf via Securonix,medium,stale; shared hosting possible
sha256,38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878,elita.msi,2026-09-24,Arctic Wolf via Securonix,high,
sha256,06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90,psychedeliclove.exe,2026-09-24,Arctic Wolf via Securonix,high,
Not accessed or checked: abuse.ch (ThreatFox, URLhaus, MalwareBazaar), SigmaHQ, FS-ISAC and the CISA joint-advisory index. The BraZetsu list comes from an OTX mirror; check it against Group-IB's own indicator list, which I did not read in full.
For your stack: import the CSV to a Sentinel watchlist, join to DeviceNetworkEvents and DeviceFileEvents, and expire the Psychedelic Stealer rows within weeks.