Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed **Breeze Comet** (formerly **UNC5669**) since 2024. **Google Threat Intelligence Group (GTIG)** and **Mandiant** teams described the threat actor as "specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers." The adversary is said to have successfully carried out at least one heist of assets worth tens of thousands of U.S. dollars. The activity overlaps with threat activity clusters tracked by **CrowdStrike** and **Trend Micro** under the monikers **Plump Spider** and **SHADOW-AETHER-064**. According to **CrowdStrike**, the e-crime group is operating out of Brazil and has been active since September 2023, monetizing their intrusions by gaining unauthorized access to internal payment systems and carrying out fraudulent transactions. ### Initial Access and Evasion Techniques Initial access to financial entities and companies offering financial services is accomplished via password spraying and voice calls impersonating IT support teams to persuade targets to install Remote Monitoring and Management (RMM) tools such as **AnyDesk**. In one case highlighted by **Axur** in November 2025, the threat actors masqueraded as IT support personnel over a WhatsApp conversation and guided the victim to install a PowerShell reconnaissance script under the pretext of updating a corporate application. Alternatively, the group has targeted vulnerable **JBoss AS** servers to deploy web shells, which are then used to deliver additional tooling, including **Chisel** and other proxy utilities, for follow-on exploitation. The threat actor's primary targets are organizations with permission to conduct transactions through banking software, APIs, and payment systems such as **Pix**, **STR**, and **Boleto**. This covers a wide range of entities like banks, payment processors, retailers, and exchanges, not to mention fintech and banking software providers. "**Breeze Comet** tactics have evolved over time to leverage a customized malware suite and compromised, trusted websites to facilitate initial access, command-and-control (C2), and to interact with financial software and payment APIs," Google said. "**Breeze Comet's** operational infrastructure may also indicate intent to expand their infrastructure footprint to other countries in Latin America and Africa." To achieve its goals, however, it must meet four requirements: have access to the **National Financial System Network (RSFN)** through an entity that already has this access; access to **mTLS** credentials that allow sending authenticated payloads with transactional orders to **Pix** or **STR**; access to several accounts in the targeted organizations' **Active Directory** and cloud environments; and possess an understanding of an organization's transfer processing procedures, network controls, fintech integrations, and anti-fraud systems. ### Evolving Tactics and Malware Arsenal Some of the other notable tactics are listed below: * Using compromised Brazilian small government websites to stage RMM tools, infostealers dressed up as legitimate tax or receipt documents, and backdoors like **XWorm**, as well as using them as C2 endpoints to bypass reputation filters and avoid detection. A similar modus operandi has been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus. * Connecting rogue hardware devices directly into retail store networks as a means to establish direct footholds and then move laterally to internal systems, followed by downloading the **Netcat** utility and custom scripts to retrieve post-exploitation frameworks. * Using **Impacket**, **ADRecon**, and **ADVipscan**, and the custom LDAP brute-forcing utility **REALBREEZE** to conduct internal reconnaissance and escalate privileges by targeting development and cloud environments. * Moving laterally by initiating unauthorized Remote Desktop Protocol (**RDP**) sessions and executing commands via **SMB** network file shares. This step also involves the deployment of **COBALTSPIN**, a Rust-based routing malware that operates as a network tunneler to communicate with and maintain persistent network access to financial API infrastructure. "By establishing a reverse **SOCKS5** proxy over a WebSocket connection, **COBALTSPIN** routes network traffic securely back and forth between the C2 and internal targets, enabling lateral movement directly through boundary firewalls without requiring built-in persistence mechanisms that might trigger detection," Google said. **Breeze Comet's** persistence mechanisms have evolved from dropping commercial RMM tools in 2024 to deploying malicious Kubernetes pods a year later and stealing cloud secrets by exfiltrating them to public-facing notepad websites like "dontpad[.]com." Since then, the threat actor has also been observed making use of multiple custom backdoors as a redundant access method and expanding their foothold: * **LIGHTPAINT**, a Java-based backdoor that's used to install the legitimate **SoftEther VPN** and configure it for automated persistence. * **MILDFROST**, a passive Java JAR backdoor that's used to establish covert DNS tunnels. * **KICKPLATE**, a Nim-based backdoor that impersonates Windows Update Health Tools and is used to deliver secondary payloads and runs commands to control SOCKS5 tunnelers. * **BOATBEAM**, a Golang-based backdoor that initiates a fake IIS HTTPS server on port 443. To make sure these persistence mechanisms are not detected and removed, the threat actor executes PowerShell commands to disable **Windows Defender's** real-time monitoring on the compromised hosts. ### Final Stages and LLM Integration In the final stage, **COBALTSPIN** and compromised privileged accounts are used to access core financial applications and execute hundreds of fraudulent transactions. Once complete, event logs are cleared to minimize the forensic footprint and conceal any API interactions with financial software and payment systems. Any directory created during the course of the intrusion is also deleted. The presence of verbose explanatory comments and standardized execution headers indicates the use of a large language model (**LLM**) to compress the malware development lifecycle. A previous analysis from **Trend Micro** in May 2026 also found some scripts to include "descriptions of self-reasoning and autonomous decision-making processes." "While the Latin American cybercrime ecosystem has historically been defined by client-side, high-volume retail fraud, **Breeze Comet's** campaigns represent a notable shift that may serve as a model for future financially motivated threats against organizations in this region," Google said. "This transition from opportunistic retail banking fraud to direct intrusions into the core financial switch and instant payment infrastructure is notable not just for this shift in targeting, but also the capabilities of the threat actor. As threat groups increasingly leverage LLMs to streamline routine tradecraft, defenders must anticipate shorter adversary turnaround times and heightened pressure on interconnected financial ecosystems."