Breeze Comet Targeting Brazilian Financial Systems

Breeze Comet (formerly tracked as UNC5669) is a financially motivated threat actor that has been targeting Brazilian financial services, retail, and e-commerce organizations since 2024. The group specializes in gaining unauthorized access to internal payment systems, including Pix, STR, and Boleto, to conduct fraudulent transfers. By leveraging a custom malware suite and LLM-assisted development, they maintain persistent access to core financial API infrastructure. Their operation requires compromising mTLS credentials and Active Directory environments to manipulate transactional flows. The group's toolkit includes backdoors such as LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM, alongside the COBALTSPIN routing malware. The actor's capability to move laterally through boundary firewalls and their focus on core payment switches represents a significant escalation in regional cybercrime maturity.

Attack Chain

1. Initial access via password spraying or social engineering (voice calls/WhatsApp) to trick users into installing RMM tools like AnyDesk.
2. Exploitation of vulnerable JBoss AS servers to upload web shells for secondary payload delivery.
3. Internal reconnaissance using tools such as ADRecon, ADVipscan, and the custom REALBREEZE LDAP brute-forcing utility.
4. Lateral movement initiated via unauthorized RDP sessions and execution of commands via SMB network shares.
5. Deployment of the Rust-based COBALTSPIN malware to establish a reverse SOCKS5 proxy over WebSocket connections for secure C2 communication.
6. Persistence establishment using malicious Kubernetes pods, SoftEther VPN, or custom backdoors like KICKPLATE (impersonating Windows Update Health Tools).
7. Execution of fraudulent transactions using compromised mTLS credentials and privileged access to financial APIs.
8. Anti-forensics activity involving clearing event logs and deleting temporary directories.

Impact

Breeze Comet has successfully conducted heists of assets worth tens of thousands of U.S. dollars. By directly targeting core financial infrastructure and payment switches, the actor poses a systemic risk to the operational integrity of Brazilian payment systems. The compromise of privileged financial API access allows for the execution of large-scale fraudulent transactions, which can result in significant financial loss, regulatory penalties, and reputational damage to affected fintech and banking entities.

Recommendation

• Deploy detection for COBALTSPIN network patterns (reverse SOCKS5 proxies over WebSockets) at the network egress.
• Audit and restrict administrative access to internal payment APIs and mTLS credentials, ensuring robust monitoring of authenticated transactional orders.
• Implement strict control over the use of RMM tools like AnyDesk; block associated outbound connections if not explicitly required by business functions.
• Monitor for suspicious use of LDAP/Active Directory enumeration tools (ADRecon, ADVipscan) within the corporate environment.
• Harden JBoss AS servers against web shell deployment and maintain rigorous patching cycles for all internet-facing infrastructure.