A financially motivated threat actor known as Breeze Comet (formerly UNC5669) has been targeting Brazilian financial services, retail, and e-commerce organizations since 2024. The group specializes in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. Google Threat Intelligence Group (GTIG) and Mandiant have been tracking this adversary and provided detailed descriptions of their tactics. The threat actor has executed hundreds of fraudulent transactions through Brazilian payment infrastructure. The campaign highlights ongoing risks to the Brazilian financial sector from sophisticated, targeted cybercriminal operations.
Breeze Comet (formerly UNC5669, also tracked as Plump Spider and SHADOW-AETHER-064) is a financially motivated Brazilian threat actor active since September 2023, targeting Brazilian financial services, retail, and e-commerce organizations. Initial access is achieved via password spraying and voice/WhatsApp-based vishing attacks impersonating IT support to install RMM tools (e.g., AnyDesk), or by exploiting vulnerable JBoss AS servers to deploy web shells, then delivering proxy tools like Chisel. Targets must have access to Brazil's National Financial System Network (RSFN), mTLS credentials for Pix/STR APIs, Active Directory and cloud environment access, and knowledge of transfer processing and anti-fraud systems. The actor stages RMM tools, infostealers disguised as tax/receipt documents, and backdoors (including XWorm) on compromised Brazilian small government websites, which also serve as C2 endpoints to bypass reputation filters. Rogue hardware devices are physically inserted into retail store networks for lateral access. Internal reconnaissance uses Impacket, ADRecon, ADVipscan, and custom tool REALBREEZE (LDAP brute-forcer). Lateral movement occurs via unauthorized RDP sessions and SMB command execution. COBALTSPIN, a Rust-based routing malware, establishes a reverse SOCKS5 proxy over WebSocket to tunnel traffic between C2 and internal financial API infrastructure without persistence mechanisms. Custom backdoors include: LIGHTPAINT (Java-based, installs SoftEther VPN), MILDFROST (passive Java JAR, DNS tunneling), KICKPLATE (Nim-based, impersonates Windows Update Health Tools, delivers secondary payloads and controls SOCKS5 tunnelers), and BOATBEAM (Golang-based, fake IIS HTTPS server on port 443). Persistence evolved from commercial RMM tools to malicious Kubernetes pods and cloud secret exfiltration to public notepad sites like dontpad[.]com. Windows Defender real-time monitoring is disabled via PowerShell. In the final stage, COBALTSPIN and compromised privileged accounts are used to execute hundreds of fraudulent transactions via banking software and payment APIs (Pix, STR, Boleto). Event logs and created directories are cleared post-operation. LLM usage is suspected in malware development based on verbose explanatory comments and autonomous decision-making descriptions found in scripts. Infrastructure expansion indicators suggest intent to target other Latin American countries and Africa (activity replicated in Nigeria, Paraguay, Ghana, Venezuela).
1. Monitor and restrict use of RMM tools (e.g., AnyDesk) to approved, documented use cases; alert on unauthorized installations. 2. Implement multi-factor authentication and monitor for password spraying attempts against all accounts, especially those with access to financial systems and APIs. 3. Patch and harden JBoss AS servers; scan for web shells on internet-facing application servers. 4. Monitor for unauthorized RDP sessions, SMB lateral movement, and unusual Active Directory queries (e.g., LDAP enumeration). 5. Detect and alert on PowerShell commands disabling Windows Defender or modifying security tool configurations. 6. Audit and monitor access to financial APIs (Pix, STR, Boleto) and the RSFN; implement anomaly detection for unusual transaction volumes or patterns. 7. Restrict and audit mTLS credential usage for payment system APIs. 8. Monitor cloud environments for unauthorized secret access or exfiltration, including to public notepad sites (e.g., dontpad[.]com). 9. Implement network monitoring for reverse SOCKS5 proxy traffic and WebSocket-based C2 communications, particularly to/from financial API infrastructure. 10. Audit Kubernetes environments for unauthorized or malicious pod deployments. 11. Implement physical security controls in retail environments to prevent unauthorized hardware device insertion into network infrastructure. 12. Monitor DNS traffic for tunneling indicators (associated with MILDFROST). 13. Block known malicious tools: Chisel, Netcat in unauthorized contexts, Impacket, ADRecon, ADVipscan. 14. Review and harden event log configurations; alert on bulk event log clearing. 15. Educate employees on vishing and WhatsApp-based IT support impersonation tactics. 16. Block or monitor traffic to/from compromised government websites used for staging and C2, especially in Brazil, Nigeria, Paraguay, Ghana, and Venezuela. 17. Deploy endpoint detection for KICKPLATE (impersonating Windows Update Health Tools) and BOATBEAM (fake IIS HTTPS server on port 443). 18. Anticipate LLM-accelerated adversary development cycles and shorten detection and response timelines accordingly.
dontpad[.]com (used for cloud secret exfiltration), COBALTSPIN (Rust-based SOCKS5/WebSocket tunneling malware), LIGHTPAINT (Java-based backdoor installing SoftEther VPN), MILDFROST (passive Java JAR backdoor with DNS tunneling), KICKPLATE (Nim-based backdoor impersonating Windows Update Health Tools), BOATBEAM (Golang-based backdoor running fake IIS HTTPS server on port 443), REALBREEZE (custom LDAP brute-forcing utility), XWorm (backdoor staged on compromised government websites), Chisel (proxy utility used post-exploitation), Netcat utility (downloaded post-physical device insertion), Impacket (used for lateral movement and reconnaissance), ADRecon (used for internal reconnaissance), ADVipscan (used for internal reconnaissance), Compromised Brazilian small government websites (used for staging and C2), PowerShell reconnaissance scripts disguised as corporate application updates, Malicious Kubernetes pods (used for persistence), Fake IIS HTTPS server on port 443 (BOATBEAM indicator), WhatsApp-based IT support impersonation for RMM tool installation, Rogue hardware devices physically inserted into retail store networks
