Full Report
Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024. Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as "specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers." The adversary
Analysis Summary
# Threat Actor: Breeze Comet
## Attribution & Identity
* **Name:** Breeze Comet
* **Aliases:** UNC5669 (Mandiant/Google), Plump Spider (CrowdStrike), SHADOW-AETHER-064 (Trend Micro).
* **Origin:** Operates out of Brazil.
* **Associations:** Financially motivated e-crime group.
## Activity Summary
Breeze Comet has been active since at least September 2023, with a significant surge in activity noted throughout 2024 and 2025. The group specializes in high-value fraudulent transfers by compromising Brazilian financial infrastructure. Notable operations include a heist valued in the tens of thousands of USD and the execution of hundreds of fraudulent transactions through unauthorized access to internal payment systems. Recent telemetry suggests the group is expanding its footprint beyond Brazil into other Latin American and African regions.
## Tactics, Techniques & Procedures
* **Initial Access:**
* Password spraying.
* Social engineering (voice calls/WhatsApp) impersonating IT support.
* Exploitation of vulnerable JBoss AS servers.
* **Persistence & Execution:**
* Deployment of web shells and Remote Monitoring and Management (RMM) tools.
* Use of PowerShell reconnaissance scripts.
* **Lateral Movement & Privilege Escalation:**
* Unauthorized RDP sessions and SMB network file shares.
* LDAP brute-forcing.
* Physical Access: Connecting rogue hardware devices directly into retail store networks.
* **Evasion:**
* Staging malware on compromised small government websites to bypass reputation filters.
* **Financial Manipulation:**
* Acquisition of mTLS credentials to authenticate transactional payloads.
* Direct interaction with financial APIs and payment systems.
**MITRE ATT&CK IDs Mentioned/Inferred:**
* T1078 (Valid Accounts - via password spraying)
* T1566 (Phishing - via WhatsApp/Voice)
* T1210 (Exploitation of Remote Services - JBoss AS)
* T1021.001 (Remote Services: Remote Desktop Protocol)
* T1021.002 (Remote Services: SMB/Windows Admin Shares)
* T1090 (Proxy - via Chisel/COBALTSPIN)
## Targeting
* **Sectors:** Financial services, banking, fintech, payment processors, retail, e-commerce, and cryptocurrency exchanges.
* **Geography:** Primarily **Brazil**. Emerging activity detected in **Nigeria, Paraguay, Ghana, and Venezuela**.
* **Victims:** Organizations with access to the National Financial System Network (RSFN) and users of payment systems like Pix, STR, and Boleto.
## Tools & Infrastructure
* **Malware Families:**
* **COBALTSPIN:** A Rust-based network tunneler used for persistent API access.
* **XWorm:** A multi-functional backdoor.
* **REALBREEZE:** Custom LDAP brute-forcing utility.
* **Utilities:** AnyDesk (RMM), Chisel (Proxying), Netcat, Impacket, ADRecon, ADVipscan.
* **Infrastructure:**
* Compromised Brazilian government domains used for C2 and malware hosting.
* Defanged examples: `[domain].gov.br` (general pattern mentioned).
## Implications
Breeze Comet represents a sophisticated, localized threat that has achieved deep technical understanding of regional financial protocols (Pix/STR). Their shift from simple malware to "rogue hardware" and the theft of mTLS certificates indicates a high level of operational maturity. Their expansion into Africa and other LATAM countries suggests they are exporting their successful "Brazilian fraud model" to other emerging markets with similar payment infrastructures.
## Mitigations
* **Identity Security:** Implement strict Multi-Factor Authentication (MFA) to mitigate password spraying and RDP hijacking.
* **Network Defense:** Restrict the use of RMM tools (AnyDesk, etc.) to authorized personnel only and monitor for unauthorized installations.
* **API Security:** Protect mTLS certificates and private keys used for National Financial System (RSFN) access using Hardware Security Modules (HSMs).
* **Physical Security:** Implement Port Security (e.g., 802.1X) on retail network jacks to prevent rogue hardware implants.
* **Vulnerability Management:** Patch legacy middleware such as JBoss AS servers immediately.