Slim Spider Targets Brazilian Financial Institutions for Crypto Secrets and Payment Access
Summary
CrowdStrike says Slim Spider has targeted Brazilian financial institutions since at least March 2026, stealing cloud credentials and crypto-custody secrets. Separately, Breeze Comet has infiltrated financial systems to carry out fraudulent payments.
Key points
- CrowdStrike tracks Slim Spider as a Brazil-based, financially motivated actor targeting financial institutions since at least March 2026.
- In an observed intrusion, the group used custom Bash scripts to query cloud instance metadata and steal temporary credentials.
- Slim Spider enumerated cloud-stored secrets and targeted credentials tied to digital assets, including cryptocurrency custody secrets.
- The actor used OpenSSL for cryptographic signing, deployed backdoors on cloud container nodes, and used likely compromised Azure DevOps credentials to deploy implants to Kubernetes.
- CrowdStrike linked Slim Spider to panels for endpoint scanning, email reconnaissance, and bulk Pix transfers, and identified MikeDor as a Go-based backdoor.
- GTIG and Mandiant say Breeze Comet has targeted Brazilian financial systems since 2024 to execute fraudulent transactions through Pix, Boleto, and STR.
- Researchers say Breeze Comet has also used compromised government websites to stage malware and extended its targeting to municipal websites in other countries.
Article Details
- Attack Vectors
- Slim Spider used custom Bash scripts to query cloud instance metadata and steal temporary cloud credentials over socket connections.
- After gaining cloud access, Slim Spider enumerated secrets in the cloud credential manager and modified secret-extraction scripts with sed to target credentials associated with digital financial assets.
- Slim Spider used cast from the Foundry Ethereum developer toolkit to derive a wallet address from a stolen private key and implemented cloud-native cryptographic signing with OpenSSL.
- Slim Spider deployed backdoors disguised as infrastructure-related binaries on cloud container-service nodes and used likely compromised Azure DevOps credentials to run malicious pipelines that deployed implants to a managed Kubernetes cluster.
- Breeze Comet infiltrated systems used by Brazilian financial organizations to initiate unauthorized payments through Pix, Boleto, and STR.
- Breeze Comet used insufficiently secure Brazilian government websites to stage malware and leveraged their reputation in follow-on social-engineering attacks.
MITRE ATT&CK
T1036 · MasqueradingSlim Spider deployed backdoors disguised as infrastructure-related binaries; one implant was named spi to impersonate SPI.T1041 · Exfiltration Over C2 ChannelCrowdStrike reported that Slim Spider exfiltrated digital asset custody secrets.T1059.004 · Unix ShellSlim Spider used custom Bash scripts for cloud credential theft and cryptographic signing.T1059.009 · Cloud APISlim Spider ran malicious pipelines through Azure DevOps to deploy implants across a managed Kubernetes cluster.T1078.004 · Cloud AccountsSlim Spider likely used compromised credentials to access Azure DevOps.T1550.001 · Application Access TokenSlim Spider used a stolen private key with cast to derive the associated Ethereum wallet address.T1552.005 · Cloud Instance Metadata APISlim Spider queried cloud instance metadata with custom Bash scripts to obtain temporary cloud credentials.T1555 · Credentials from Password StoresSlim Spider enumerated secrets in the cloud credential manager, focusing on credentials for digital financial assets.T1583.003 · Virtual Private ServerBreeze Comet used compromised or insecure municipal websites to stage malware; the article describes the sites as Brazilian government websites and municipal websites in several countries.T1598 · Phishing for InformationBreeze Comet leveraged the reputation of government websites in follow-on social-engineering attacks against targets.
Threat Actors
BREEZE COMETCybercrime group reported to infiltrate Brazilian financial systems and abuse payment infrastructure for financial gain.CL-CRI-1163Name explicitly given as an alias of Breeze Comet.Plump SpiderName explicitly given as an alias of Breeze Comet.SHADOW-AETHER-064Name explicitly given as an alias of Breeze Comet.SLIM SPIDERCrowdStrike's name for a Brazil-based financially motivated activity cluster targeting Brazilian financial institutions.
Malware
Vendors
CrowdStrikeCrowdStrike also linked Slim Spider and Breeze Comet to sophisticated operations that steal credentials, deploy backdoors, and abuse Brazilian payment systems for fraudulent transactions.GoogleGoogle Threat Intelligence Group (GTIG) and Mandiant said the Portuguese-speaking hacking group breaks into systems that Brazilian financial organizations use to perform transactions and initiates payments for itself.MandiantGoogle Threat Intelligence Group (GTIG) and Mandiant said the Portuguese-speaking hacking group breaks into systems that Brazilian financial organizations use to perform transactions and initiates payments for itself.MicrosoftPainel de Emails Entra ID, an email reconnaissance panel that searches compromised Microsoft 365 mailboxes sorted into finance, admin, and Brazil categories
Products
Azure DevOpsSlim Spider deployed backdoors and abused Azure DevOps and Kubernetes.Boletoaccess to the financial applications that the breached organizations use to make payments, including Pix, Boleto, and the Reserves Transfer System (STR), and execute hundreds of fraudulent transactions.Foundry“Following exfiltration of digital asset custody secrets, Slim Spider invoked cast, a component of the Foundry Ethereum developer toolkit, to derive the Ethereum wallet address associated with a stolen private key,”KubernetesSlim Spider deployed backdoors and abused Azure DevOps and Kubernetes.Microsoft 365 Apps for EnterprisePainel de Emails Entra ID, an email reconnaissance panel that searches compromised Microsoft 365 mailboxes sorted into finance, admin, and Brazil categoriesPixinstitutions since at least March 2026, with a focus on cloud environments, cryptocurrency assets, and Pix payment infrastructure.Reserves Transfer System (STR)that the breached organizations use to make payments, including Pix, Boleto, and the Reserves Transfer System (STR), and execute hundreds of fraudulent transactions.
Tools
cast“Following exfiltration of digital asset custody secrets, Slim Spider invoked cast, a component of the Foundry Ethereum developer toolkit, to derive the Ethereum wallet address associated with a stolen private key,”NEXUS // ScannerNEXUS // Scanner, an API endpoint-scanning panel that uses Ollama to slot endpoints into 16 categories, such as fintech, banking, payment, and cryptocurrency, and rank them based on availability and authenticationOllamaNEXUS // Scanner, an API endpoint-scanning panel that uses Ollama to slot endpoints into 16 categories, such as fintech, banking, payment, and cryptocurrency, and rank them based on availability and authenticationOpenSSLAttackers used custom Bash scripts and OpenSSL for stealthy cloud abuse.Painel de Emails Entra IDPainel de Emails Entra ID, an email reconnaissance panel that searches compromised Microsoft 365 mailboxes sorted into finance, admin, and Brazil categoriesPainel PixPainel Pix, a transaction panel designed to execute bulk unauthorized Pix transfers from compromised accounts
Countries
BrazilSlim Spider is a Brazil-based threat actor targeting financial institutions.GhanaTo make matters worse, Breeze Comet has attempted to replicate this formula in other regions, hacking municipal websites in countries like Nigeria, Paraguay, Ghana, and Venezuela.NigeriaTo make matters worse, Breeze Comet has attempted to replicate this formula in other regions, hacking municipal websites in countries like Nigeria, Paraguay, Ghana, and Venezuela.ParaguayTo make matters worse, Breeze Comet has attempted to replicate this formula in other regions, hacking municipal websites in countries like Nigeria, Paraguay, Ghana, and Venezuela.VenezuelaTo make matters worse, Breeze Comet has attempted to replicate this formula in other regions, hacking municipal websites in countries like Nigeria, Paraguay, Ghana, and Venezuela.