Brazil’s financial sector is facing a growing cybercrime threat from a financially motivated group known as Breeze Comet, formerly tracked as UNC5669. Since 2024, the threat actor has targeted organizations across Brazil’s financial services, retail, and e-commerce industries with the apparent goal of manipulating banking software and payment infrastructure to conduct fraudulent transactions.
According to the Google Threat Intelligence Group (GTIG) and Mandiant, Breeze Comet specializes in compromising payment systems and banking applications. Investigators say the group has already succeeded in stealing assets worth tens of thousands of U.S. dollars in at least one operation.
The activity has also been linked to threat clusters tracked by other cybersecurity companies. CrowdStrike has associated the activity with Plump Spider, while Trend Micro tracks related operations under the name SHADOW-AETHER-064.
CrowdStrike describes the group as a Brazil-based e-crime operation that has been active since at least September 2023. Rather than relying solely on conventional banking malware, the attackers seek direct access to organizations’ internal payment infrastructure, allowing them to initiate unauthorized financial transactions.
How Breeze Comet Gains Initial Access
Breeze Comet uses a combination of technical attacks and social engineering to obtain access to targeted organizations.
One of the group’s techniques involves password spraying, in which attackers attempt commonly used passwords against multiple accounts. The group has also impersonated IT support personnel during phone calls or messaging conversations, convincing employees to install legitimate remote-management software such as AnyDesk.
In a case documented by Axur in November 2025, attackers posed as corporate IT support staff through WhatsApp. They instructed the victim to install a PowerShell reconnaissance script while claiming it was required to update a corporate application.
This combination of social engineering and legitimate administrative tools can make the intrusion particularly difficult to identify. Because RMM software has legitimate business uses, its presence may not immediately trigger security alerts.
Exploiting Vulnerable JBoss Servers
Breeze Comet has also exploited vulnerable JBoss AS servers to gain access to targeted environments.
After compromising an exposed server, the attackers can deploy web shells that provide remote command execution. They have subsequently used tools such as Chisel and other proxy utilities to establish access to internal systems and continue their operations.
The Financial Infrastructure Is the Main Target
The group appears particularly interested in organizations that have authorization to process transactions through Brazil’s banking and payment infrastructure.
Targets can include:
- Banks and financial institutions
- Payment processors
- Retail companies
- Cryptocurrency and financial exchanges
- Fintech companies
- Banking software providers
- Organizations using payment APIs
The attackers’ interest extends to systems supporting Brazilian payment mechanisms such as Pix, STR, and Boleto.
Google describes this as an important evolution in the group’s operations. Rather than simply stealing credentials or conducting conventional retail banking fraud, Breeze Comet seeks access to the underlying systems responsible for processing financial transactions.
“Breeze Comet tactics have evolved over time to leverage a customized malware suite and compromised, trusted websites to facilitate initial access, command-and-control (C2), and to interact with financial software and payment APIs.”
Four Requirements for a Successful Attack
A successful Breeze Comet operation requires access to several critical components of a victim’s environment.
First, attackers need access to the National Financial System Network (RSFN) through an organization that already has connectivity to it.
Second, they need mutual TLS (mTLS) credentials capable of authenticating transactional requests involving Pix or STR.
Third, the attackers seek access to multiple accounts within the victim’s Active Directory and cloud environments.
Finally, they need detailed knowledge of how the organization’s financial operations work, including transaction-processing procedures, network security controls, fintech integrations, and anti-fraud mechanisms.
This combination highlights why the campaign represents a serious risk. Compromising a single employee account is not necessarily enough. Attackers must progressively expand their access and understand how the victim’s financial infrastructure operates before attempting large-scale fraud.
Compromised Government Websites Used as Attack Infrastructure
One of the more unusual elements of Breeze Comet’s campaigns is the use of compromised small Brazilian government websites.
The attackers have reportedly used these trusted sites to host RMM software, information stealers disguised as legitimate tax or receipt documents, and backdoors such as XWorm. Compromised websites can also function as command-and-control infrastructure.
Using legitimate or trusted websites can help attackers evade reputation-based security controls. Security products may be less suspicious of traffic associated with established government domains than newly registered malicious infrastructure.
Similar techniques have reportedly been observed in countries including Nigeria, Paraguay, Ghana, and Venezuela, suggesting that the group’s infrastructure and targeting strategy may be expanding beyond Brazil.
Rogue Hardware Provides Another Entry Point
Breeze Comet has also experimented with a technique that moves the attack beyond traditional malware delivery.
In some cases, attackers have connected unauthorized hardware devices directly to retail-store networks. This gives them a foothold inside the organization’s network and can provide a pathway toward internal systems.
Once connected, the attackers have used tools such as Netcat and custom scripts to retrieve additional post-exploitation frameworks.
The technique demonstrates the importance of physical network security alongside conventional endpoint and identity protection. A well-secured internet perimeter offers little protection if an attacker can obtain direct access to an internal network through an unmanaged device.
Reconnaissance and Lateral Movement
After establishing an initial foothold, Breeze Comet performs extensive reconnaissance to identify valuable systems, accounts, and network paths.
Researchers have observed the use of tools including:
- Impacket for network and Windows environment operations
- ADRecon for Active Directory reconnaissance
- ADVipscan for identifying systems and network resources
- REALBREEZE, a custom LDAP brute-forcing utility
The attackers have also focused on development and cloud environments, where privileged credentials and sensitive configuration information may be available.
For lateral movement, the group has used unauthorized Remote Desktop Protocol (RDP) sessions and commands executed through SMB network shares.
COBALTSPIN Helps Reach Financial APIs
One of the group’s notable custom tools is COBALTSPIN, a Rust-based network tunneling malware.
COBALTSPIN is designed to provide attackers with a communication channel into internal networks and financial API infrastructure. It establishes a reverse SOCKS5 proxy over WebSocket, allowing traffic to travel between the attackers’ command-and-control infrastructure and compromised internal systems.
This approach can allow attackers to move through network boundaries without installing conventional persistence mechanisms that might attract security monitoring.
The ability to tunnel traffic directly toward financial infrastructure is particularly valuable to an attacker whose ultimate objective is to manipulate payment systems.
A Growing Collection of Custom Backdoors
Breeze Comet’s persistence strategy has changed considerably over time.
In 2024, the group frequently relied on commercial RMM software. By 2025, researchers observed more advanced techniques, including malicious Kubernetes pods and the theft of cloud secrets.
The attackers have also used public-facing note-taking websites, including services such as Dontpad, as destinations for exfiltrated information.
Several custom backdoors have been identified as part of the group’s toolkit.
LIGHTPAINT
LIGHTPAINT is a Java-based backdoor used to install the legitimate SoftEther VPN software and configure it for automated persistence.
MILDFROST
MILDFROST is a passive Java JAR backdoor designed to create covert communication channels using DNS tunneling.
KICKPLATE
KICKPLATE is a Nim-based backdoor that masquerades as Windows Update Health Tools. It can deliver additional payloads, execute commands, and control SOCKS5 tunneling tools.
BOATBEAM
BOATBEAM is a Golang-based backdoor that creates a fake IIS HTTPS server on port 443, providing another method for maintaining access to compromised systems.
The attackers have also been observed using PowerShell commands to disable Windows Defender real-time monitoring, helping protect their malicious tools from detection.
The Final Objective: Fraudulent Transactions
Once Breeze Comet has obtained sufficient privileges and understands the victim’s financial environment, the operation enters its most damaging stage.
Attackers use compromised privileged accounts and tools such as COBALTSPIN to reach core financial applications and payment infrastructure. Investigators have observed operations involving hundreds of fraudulent transactions.
After the transactions are completed, the attackers attempt to erase evidence.
Event logs may be cleared, directories created during the intrusion can be deleted, and traces of API interactions with banking and payment systems may be removed.
This cleanup activity is designed to reduce the forensic evidence available to defenders and delay discovery of the compromise.
Evidence of LLM-Assisted Malware Development
Another noteworthy aspect of the Breeze Comet activity is the apparent use of large language models (LLMs) during malware development.
Researchers have identified verbose explanatory comments and standardized execution headers within some of the group’s malware and scripts. These characteristics suggest that generative AI may be helping attackers develop or modify malicious tooling more efficiently.
Trend Micro reported similar findings in an analysis published in May 2026, noting that some scripts contained descriptions related to self-reasoning and autonomous decision-making.
The significance is less about AI creating entirely autonomous malware and more about how LLMs can reduce the time required to write, modify, document, and troubleshoot malicious code.
Why Breeze Comet Matters
Breeze Comet represents a potentially significant evolution in financially motivated cybercrime in Latin America.
Historically, much of the region’s cybercrime ecosystem has focused on high-volume consumer and retail banking fraud. Breeze Comet’s campaigns demonstrate a different model: directly compromising the organizations and infrastructure responsible for processing financial transactions.
That shift gives attackers access to potentially much larger financial opportunities while also increasing the potential impact of a single successful intrusion.
The threat is particularly concerning because modern financial ecosystems are highly interconnected. Banks, fintech companies, retailers, payment processors, software providers, APIs, and cloud environments can all form part of the same transaction chain.
A compromise at one point in that chain can therefore create consequences far beyond a single endpoint or employee account.
What Organizations Can Do
Organizations operating financial and payment infrastructure should consider strengthening defenses across identity, endpoint, network, cloud, and application layers.
Key measures include:
- Enforce phishing-resistant multifactor authentication for privileged accounts.
- Monitor for unusual use of RMM applications such as AnyDesk.
- Restrict administrative access and regularly review Active Directory privileges.
- Monitor RDP and SMB activity for unusual lateral movement.
- Protect mTLS credentials and other authentication material used by payment APIs.
- Segment payment infrastructure from ordinary corporate networks.
- Detect unauthorized hardware connected to internal networks.
- Monitor cloud environments for unusual access to secrets and credentials.
- Investigate suspicious PowerShell activity and attempts to disable security controls.
- Maintain detailed, tamper-resistant logs for financial transactions and API activity.
- Regularly test anti-fraud controls against compromised-account scenarios.
- Monitor Kubernetes environments for unauthorized workloads and persistence mechanisms.
- Review third-party and fintech integrations for unexpected changes.
Organizations should also ensure that incident-response teams understand the difference between an ordinary endpoint compromise and an intrusion targeting the systems that actually authorize financial transactions.
A Warning for the Financial Industry
Breeze Comet’s operations illustrate how financially motivated attackers are moving beyond traditional credential theft toward direct attacks on payment infrastructure.
The group’s combination of social engineering, compromised websites, vulnerable servers, custom malware, network tunneling, stolen credentials, and payment-system knowledge gives it multiple paths to reach high-value systems.
The apparent use of LLMs adds another dimension by potentially allowing threat actors to accelerate the development and modification of their tools.
As Google noted, the shift from opportunistic retail fraud toward direct intrusions into financial switches and instant-payment infrastructure could become a model for future cybercriminal campaigns.
For financial institutions and companies connected to payment ecosystems, the lesson is clear: protecting customer-facing applications alone is no longer enough. Defenders must also secure the identities, networks, APIs, credentials, cloud environments, and transaction-processing systems that sit behind the payment experience.
The faster attackers can develop their tooling and adapt their operations, the more important continuous monitoring, strong identity controls, network segmentation, and transaction-level fraud detection will become.
