Financial-Crime - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/financial-crime/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 08 Sep 2026 16:48:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSlim Spider Targets Brazilian Financial Institutions via Cloud Infrastructurehttps://feed.craftedsignal.io/briefs/2026-09-slim-spider/Tue, 08 Sep 2026 16:48:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-slim-spider/Slim Spider is a financially motivated actor targeting Brazilian financial organizations by stealing cloud credentials and manipulating DevOps pipelines to gain unauthorized access to digital asset custody systems and payment infrastructure.Slim Spider is a newly identified, Brazil-based threat actor active since at least March 2026, focusing on financial institutions and digital asset platforms. The actor demonstrates deep operational knowledge of Brazilian financial infrastructure, specifically targeting the Pix instant payment system. Their methodology involves sophisticated cloud-native attacks, moving away from traditional retail banking fraud toward direct intrusion into core financial switches. The group employs custom Bash scripts, Go-based backdoors (MikeDor), and automated tooling to enumerate cloud environments, steal temporary credentials from metadata services, and harvest secrets from credential managers. They further expand their reach by compromising Azure DevOps pipelines to deploy malicious implants - such as those impersonating the Sistema de Pagamentos Instantâneos (SPI) - into Kubernetes clusters. These actions are supported by custom reconnaissance and transaction-focused panels that categorize financial endpoints and facilitate fraudulent payments.

Attack Chain

  1. Initial access is established via compromised credentials to gain entry into the target organization's cloud and DevOps environment.
  2. The actor performs cloud environment discovery and enumerates secrets stored within the cloud credential manager.
  3. Custom Bash scripts are deployed to query cloud instance metadata and exfiltrate temporary credentials over socket connections.
  4. The actor uses the 'sed' command to modify and repurpose scripts for digital asset secret extraction.
  5. Attacker deploys malicious pipelines within Azure DevOps to distribute implants across managed Kubernetes clusters.
  6. Backdoors mimicking infrastructure binaries are deployed to nodes to maintain persistence and blend with legitimate tooling.
  7. The actor utilizes the Foundry 'cast' component to derive Ethereum wallet addresses from stolen private keys.
  8. Final objective is achieved by initiating fraudulent bulk Pix payments via the compromised financial infrastructure.

Impact

Slim Spider's activities target high-value digital asset custody credentials, which can lead to catastrophic financial loss through the unauthorized transfer of cryptocurrency and fiat currency. By specifically compromising the Pix instant payment infrastructure, the actor gains the ability to execute unauthorized bulk transactions, representing a significant shift from retail banking fraud to direct financial platform exploitation within Brazil.

Recommendation

Prioritize monitoring of cloud and CI/CD environments for suspicious credential access and unauthorized pipeline executions.

  • Audit and restrict access to cloud instance metadata services, particularly for containers where such access is not required.
  • Implement strict monitoring of Azure DevOps pipeline configurations for unauthorized modifications or external source integrations.
  • Monitor Kubernetes cluster logs for the deployment of unexpected container images or binaries mimicking core infrastructure components.
  • Enforce strict identity and access management controls for cloud-native secret management services to prevent bulk secret extraction.
]]>highthreatfinancial-crimecloud-securitydevopscredential-theftkubernetes