NCC Group identifies AI toolkit that profiles compromised corporate systems

BraZetsu, an AI-enhanced Windows malware framework, has evolved into a specialized toolkit for initial access to computer systems, according to NCC Group's review of cyber threats in the third quarter of 2026. The framework uses AI models to automate victim profiling, analyze compromised environments and identify valuable corporate systems. It searches for enterprise software, financial data, digital certificates and cloud credentials, helping operators identify access they can sell to other criminals. Researchers also observed brokers advertising compromised VPN, Remote Desktop Protocol and SSH access, alongside cloud identities and source code repositories. The capability described concerns identifying and valuing compromised access, rather than autonomous execution of an entire ransomware attack.