BREEZE COMET: How Brazil’s Payment Systems Were Targeted

Brazilian financial organizations are facing a threat model that goes beyond conventional online-banking fraud. According to Google Threat Intelligence Group (GTIG) and Mandiant, the financially motivated actor tracked as BREEZE COMET, formerly UNC5669, has conducted intrusions intended to manipulate payment systems, banking software, and transaction-processing environments.

The research describes activity beginning in 2024 against Brazilian financial services, retail, and eCommerce organizations. The actor’s targets include banks, payment processors, retailers, exchanges, fintech companies, and providers of banking software. Its reported interests include Pix, the Brazilian Reserves Transfer System (STR), Boleto, banking APIs, and the credentials used to authenticate financial transactions.

GTIG and Mandiant also state that the activity overlaps with operations publicly reported under the names Plump Spider and SHADOW-AETHER-064. That naming overlap is a research observation, not an independent attribution to a separate group.

The access problem is broader than phishing

BREEZE COMET has used several routes into victim environments. In earlier intrusions, Mandiant observed password spraying and telephone-based impersonation of IT support personnel. The calls persuaded users to install remote monitoring and management software, including AnyDesk. Axur separately corroborated the use of voice phishing and suggested that the actor may have attempted to recruit insiders. The insider-recruitment point remains an assessment reported by Axur rather than a confirmed finding in every intrusion.

By mid-2025, GTIG observed a more elaborate delivery model. The actor compromised small Brazilian government websites and used them to host remote-management tools, infostealers disguised as tax or receipt documents, and backdoors such as XWORM. One example cited by the researchers is ComprovantePDF.exe, a filename designed to resemble a legitimate proof-of-payment document. Automated startup-shortcut changes were observed in connection with XWORM persistence.

Compromised municipal websites served two purposes: they supported social-engineering activity and acted as command-and-control endpoints. Using trusted public-sector domains could help the traffic evade simple reputation-based filtering. GTIG later observed similar reuse of municipal domains in Nigeria, Paraguay, Ghana, and Venezuela. The researchers assess this pattern as a possible sign of expansion beyond Brazil, but the report does not confirm successful campaigns in every named country.

The research also documents a physical-access route. In 2025, BREEZE COMET connected rogue hardware devices directly to retail-store networks. From there, the actor moved into internal systems, downloaded Netcat and custom scripts, and retrieved additional post-exploitation frameworks from externally accessible directories. Trend Micro has reported another access method involving exploitation of vulnerabilities in JBoss AS servers. The supplied research does not identify a CVE for that activity.

Reconnaissance focuses on financial connectivity

Once inside, BREEZE COMET combined public tools with custom utilities. Mandiant observed Impacket, ADRecon, and ADVipscan being downloaded from GitHub repositories and executed in memory through PowerShell. The report characterizes this as a defense-evasion measure, particularly in environments with limited visibility.

The actor also deployed REALBREEZE, a custom LDAP brute-forcing utility. Reconnaissance extended beyond traditional Active Directory. BREEZE COMET searched development and cloud environments for hard-coded pipeline credentials, API keys, and privileged cloud access tokens. Custom scripts examined host files and environment variables for mutual TLS credentials and administrative certificates that could authenticate requests to core banking systems.

Search terms observed by the researchers included boleto, cnab, remessa, webhook.*pix, and instant.*payment. These terms illustrate the actor’s interest in payment workflows and integration points rather than only user workstations.

Lateral movement through ordinary protocols

BREEZE COMET used hijacked service accounts to initiate unauthorized Remote Desktop Protocol sessions and executed commands through SMB network shares. Internal network-scanning tools were used to identify available SMB paths. This behavior is significant for defenders because the traffic can resemble legitimate administration when it originates from valid accounts and approved protocols.

To cross segmented financial networks, the actor used COBALTSPIN, a custom Rust-written tunneling tool. GTIG describes it as a lightweight network tunneler that establishes a reverse SOCKS5 proxy over WebSocket. The proxy allowed traffic to move between command-and-control infrastructure and internal financial targets through network boundaries, without relying on conventional persistence mechanisms that might draw attention.

The stated objective was to reach core financial applications and authenticated transaction interfaces. The research says BREEZE COMET needed access to the Brazilian financial-sector network, known as RSFN, valid mutual TLS credentials, persistent access to accounts in Active Directory or cloud environments, and an understanding of transfer-processing and anti-fraud controls.

Redundant persistence and layered command infrastructure

The group’s tooling evolved from commercial RMM software in 2024 to a collection of custom backdoors and cloud-oriented persistence mechanisms in 2025 and 2026.

• LIGHTPAINT is a Java backdoor that installs and configures a legitimate VPN such as SoftEther for automated persistence. GTIG observed the actor adding inbound Windows Defender Firewall rules to permit traffic from the VPN manager and clearing related Windows Networking Vpn Plugin Platform event logs.
• MILDFROST is a passive Java JAR backdoor that hides in JVM process space. It can establish DNS tunnels and operate as fallback command and control by querying delegated subdomains for instructions and additional C++ executables.
• KICKPLATE is a Nim-based backdoor that impersonates Windows Update Health Tools. It controls SOCKS5 tunnelers, changes registry startup keys, and modifies Windows services. The actor also used scheduled tasks running as SYSTEM and malicious shortcuts in user startup folders.
• BOATBEAM is a Go backdoor that creates a false IIS HTTPS server on port 443. Its backdoor functions activate only after receipt of a specific session cookie, helping conceal command traffic within apparently legitimate web-server behavior.

The researchers also observed malicious Kubernetes pods used to maintain access and steal cloud secrets. Those secrets were exfiltrated to public-facing notepad services, including dontpad[.]com. On affected Windows systems, telemetry showed direct PowerShell execution of Set-MpPreference -DisableRealtimeMonitoring $true to disable Defender real-time monitoring. Mandiant additionally found evidence of event-log clearing and deletion of directories created during the intrusion.

GTIG and Mandiant assess that generative AI assisted the development of scripts for reconnaissance, credential validation, mass deployment, victim-specific pivoting, and data extraction. Their analysis identified verbose comments, standardized execution headers, and unrolled code structures that appeared less characteristic of manually authored tooling. This is a researcher assessment about development methods, not proof that every component was generated by an AI system.

From access to fraudulent transfers

Forensic evidence reviewed by Mandiant indicates that BREEZE COMET used compromised privileged accounts and COBALTSPIN to access core financial applications. In one reported case, the actor executed two waves of hundreds of fraudulent transactions within 24 to 48 hours of establishing that access. The report says at least one heist involved tens of thousands of U.S. dollars in assets.

The attackers subsequently cleared event logs across compromised hosts to obscure lateral movement, privilege escalation, and interaction with financial APIs. They also removed directories created during the operation. These actions show why financial organizations need controls that evaluate transaction authorization and identity context, not only malware presence on endpoints.

What organizations should do now

Restrict unauthorized software. Use application control to prevent execution from user-writable locations such as Windows %APPDATA%, macOS Downloads folders, and Linux temporary directories. Audit portable RMM tools and alert on unapproved services or daemons. Train staff to verify unsolicited IT-support calls through an independent channel.

Control physical and network access. Deploy 802.1X network access control at retail and branch switch ports, disable unused ports, apply MAC limits where appropriate, and secure public network jacks and communications closets. Segment workstations from servers and restrict unnecessary SMB and RDP traffic.

Strengthen identity and PowerShell monitoring. Require phishing-resistant multifactor authentication for VPN, SaaS, and other external portals. Apply lockout controls, monitor service-account RDP activity, and enable PowerShell Constrained Language Mode, Script Block Logging, and AMSI. Investigate in-memory execution of reconnaissance tools and attempts to disable endpoint protection.

Inspect outbound traffic. Do not rely solely on domain reputation or government-domain allowlists. Where operationally appropriate, use TLS decryption and deep packet inspection, restrict nonessential egress protocols, and identify unexpected WebSocket, DNS-tunneling, SOCKS5, and other tunneling behavior.

Protect cloud and payment secrets. Enforce least-privilege Kubernetes RBAC, use admission controls to block privileged containers, and apply pod and node egress policies. Remove plaintext credentials from code and CI/CD pipelines, centralize secrets in an access-logged secrets manager, and limit financial-system administration to dedicated jump hosts through privileged-access management.

Hunt for the reported artifacts. Organizations can search for the file hashes published by GTIG and Mandiant for COBALTSPIN, REALBREEZE, MILDFROST, BOATBEAM, KICKPLATE, and XWORM. The report also provides YARA rules for several of these tools and identifies relevant Google SecOps detections, including suspicious PowerShell download activity, PowerShell loading of .NET assemblies, and DNS connections to paste sites. Network hunting should treat the following as indicators rather than proof of compromise: dontpad[.]com and the defanged staging paths published in the original report, including hxxps://procon[.]go[.]gov[.]br/ComprovantePDF[.]exe and hxxps://minacu[.]go[.]gov[.]br/ComprovantePDF[.]exe. Infrastructure can be repurposed or become unavailable, so behavior-based investigation remains essential.

What remains unknown

The supplied research does not provide a CVE identifier for the JBoss AS exploitation described by Trend Micro. It also does not establish that every organization exposed to the listed infrastructure was compromised, nor does it identify all victims. The report presents possible regional expansion indicators, but does not confirm the full scope of operations outside Brazil.

Conclusion

BREEZE COMET represents a high-impact intrusion pattern in which social engineering, trusted-site abuse, physical network access, cloud credential theft, custom tunneling, and payment-system knowledge are combined into one operation. The central defensive lesson is that endpoint malware controls alone are insufficient. Financial organizations must connect identity, network, cloud, physical-access, and transaction-monitoring telemetry, while protecting the credentials and trust relationships that authorize payments.

Sources

Technical findings and recommendations are based on the Google Threat Intelligence Group and Mandiant report on BREEZE COMET.