Breeze Comet Uses Custom Malware to Target Brazilian Payment Systems
Summary
GTIG and Mandiant describe Breeze Comet intrusions into Brazilian organizations, using phishing, RMM tools, vulnerable JBoss servers and custom malware to reach payment systems. The group has executed hundreds of fraudulent transactions; expansion abroad may be underway
Key points
- Breeze Comet, formerly tracked as UNC5669, has targeted Brazilian financial services, retail and e-commerce organizations since 2024.
- Initial access methods include password spraying, impersonating IT support to induce RMM installations, and exploiting vulnerable JBoss AS servers to deploy web shells.
- Targets include organizations with access to Pix, STR and Boleto payment systems; operations require access to financial networks, mTLS credentials and privileged accounts, according to the article.
- Custom tools support persistence and movement: COBALTSPIN tunnels traffic through a reverse SOCKS5 proxy over WebSocket, while LIGHTPAINT, MILDFROST, KICKPLATE and BOATBEAM provide backdoor capabilities.
- The group has used compromised websites, malicious Kubernetes pods and stolen cloud secrets to maintain access, and has disabled Windows Defender monitoring on compromised hosts.
- COBALTSPIN and compromised privileged accounts were used to execute hundreds of fraudulent transactions; operators then cleared event logs and deleted intrusion-related directories.
- GTIG says infrastructure may indicate plans to expand beyond Brazil; researchers also report at least one heist involving assets worth tens of thousands of U.S. dollars.
Article Details
- Attack Vectors
- Password spraying against financial entities and companies offering financial services.
- Voice calls and WhatsApp messages impersonating IT support to persuade targets to install RMM tools such as AnyDesk; one reported case also involved a PowerShell reconnaissance script presented as a corporate application update.
- Exploitation of vulnerable JBoss AS servers to deploy web shells and deliver additional tooling.
- Use of compromised Brazilian small-government websites to stage RMM tools, infostealers disguised as tax or receipt documents, and backdoors, and to provide C2 endpoints.
- Connection of rogue hardware devices to retail store networks to establish footholds and move laterally.
- Use of unauthorized RDP sessions, SMB network shares, and tools including Impacket, ADRecon, ADVipscan, and REALBREEZE for lateral movement and internal reconnaissance.
- Use of COBALTSPIN to create a reverse SOCKS5 proxy over WebSocket connections and tunnel traffic to internal targets.
- Deployment of malicious Kubernetes pods, custom backdoors, and SoftEther VPN for persistence; exfiltration of cloud secrets to public-facing notepad websites.
- Use of compromised privileged accounts and access to financial applications to execute fraudulent transactions, followed by clearing event logs and deleting intrusion-created directories.
- Defensive Notes
- The article reports that Breeze Comet disables Windows Defender real-time monitoring on compromised hosts and clears event logs after fraudulent transactions, actions that can reduce endpoint visibility and forensic evidence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dontpad[.]com | Public-facing notepad website identified as a destination for exfiltrated cloud secrets. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe group moves laterally by initiating unauthorized RDP sessions.T1021.002 · SMB/Windows Admin SharesThe group executes commands through SMB network file shares during lateral movement.T1036 · MasqueradingInfostealers are disguised as legitimate tax or receipt documents, and KICKPLATE impersonates Windows Update Health Tools.T1059.001 · PowerShellA PowerShell reconnaissance script was installed in a reported incident, and the group uses PowerShell commands to disable Windows Defender real-time monitoring.T1070.001 · Clear Windows Event LogsThe group clears event logs after completing fraudulent transactions.T1071.004 · DNSMILDFROST establishes covert DNS tunnels.T1090 · ProxyCOBALTSPIN establishes a reverse SOCKS5 proxy to route traffic between C2 and internal targets.T1110.003 · Password SprayingThe group uses password spraying to gain initial access to financial entities and service providers.T1190 · Exploit Public-Facing ApplicationThe group targets vulnerable JBoss AS servers to deploy web shells.T1219 · Remote Access ToolsTargets are persuaded to install RMM tools such as AnyDesk, which the group also stages on compromised websites.T1505.003 · Web ShellWeb shells deployed on vulnerable JBoss AS servers are used to deliver additional tooling.T1562.001 · Disable or Modify ToolsThe group uses PowerShell commands to disable Windows Defender real-time monitoring on compromised hosts.T1567 · Exfiltration Over Web ServiceThe group exfiltrates cloud secrets to public-facing notepad websites, including dontpad[.]com.T1572 · Protocol TunnelingCOBALTSPIN tunnels network traffic over a WebSocket connection.T1610 · Deploy ContainerThe group used malicious Kubernetes pods as a persistence mechanism.
Threat Actors
BREEZE COMETFinancially motivated group targeting Brazilian organizations with access to banking software and payment infrastructure.Plump SpiderCrowdStrike tracking name for activity that overlaps with Breeze Comet activity.SHADOW-AETHER-064Trend Micro tracking name for activity that overlaps with Breeze Comet activity.UNC5669Earlier tracking name for Breeze Comet, according to the article.
Malware
BOATBEAM#BreezeCometCOBALTSPIN#BreezeCometKICKPLATE#BreezeCometLIGHTPAINT#BreezeCometMILDFROST#BreezeCometXWormto stage RMM tools, infostealers dressed up as legitimate tax or receipt documents, and backdoors like XWorm, as well as using them as C2 endpoints to bypass reputation filters and avoid detection.
Products
Boleto#BreezeCometJBoss ASIt also exploits vulnerable JBoss AS servers and compromised websites to deliver payloads.Kubernetespersistence mechanisms have evolved from dropping commercial RMM tools in 2024 to deploying malicious Kubernetes pods a year later and stealing cloud secrets by exfiltrating them to public-facing notepad websitesMicrosoft Active Directorywith transactional orders to Pix or STR; access to several accounts in the targeted organizations’ Active Directory and cloud environments; and possess an understanding of an organization’s transfer processingPix#BreezeCometReserves Transfer System (STR)#BreezeCometSoftEther VPNLIGHTPAINT, a Java-based backdoor that’s used to install the legitimate SoftEther VPN and configure it for automated persistenceWindows DefenderTo make sure these persistence mechanisms are not detected and removed, the threat actor executes PowerShell commands to disable Windows Defender’s real-time monitoring on the compromised hosts.
Tools
ADReconUsing Impacket, ADRecon, and ADVipscan, and the custom LDAP brute-forcing utility REALBREEZE to conduct internal reconnaissance and escalate privileges by targeting development and cloud environments.ADVipscanUsing Impacket, ADRecon, and ADVipscan, and the custom LDAP brute-forcing utility REALBREEZE to conduct internal reconnaissance and escalate privileges by targeting development and cloud environments.AnyDeskIT support teams to persuade targets to install Remote Monitoring and Management (RMM) tools such as AnyDesk.ChiselAlternatively, the group has targeted vulnerable JBoss AS servers to deploy web shells, which are then used to deliver additional tooling, including Chisel and other proxy utilities, for follow-on exploitation.ImpacketUsing Impacket, ADRecon, and ADVipscan, and the custom LDAP brute-forcing utility REALBREEZE to conduct internal reconnaissance and escalate privileges by targeting development and cloud environments.netcatto establish direct footholds and then move laterally to internal systems, followed by downloading the Netcat utility and custom scripts to retrieve post-exploitation frameworks.REALBREEZE#BreezeComet
Countries
BrazilThe group has evolved into a highly capable threat actor that executes fraudulent transfers, maintains persistence across cloud and on-premises environments, and may be expanding operations beyond Brazil.GhanaA similar modus operandi has been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus.NigeriaA similar modus operandi has been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus.ParaguayA similar modus operandi has been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus.VenezuelaA similar modus operandi has been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus.
Industries
E-commerceBreeze Comet has targeted Brazilian financial services, retail, and e-commerce organizations since 2024, using phishing, RMM tools, vulnerable servers, and custom malware to gain access to banking and payment systems.Financial ServicesBreeze Comet has targeted Brazilian financial services, retail, and e-commerce organizations since 2024, using phishing, RMM tools, vulnerable servers, and custom malware to gain access to banking and payment systems.fintechThis covers a wide range of entities like banks, payment processors, retailers, and exchanges, not to mention fintech and banking software providers.RetailBreeze Comet has targeted Brazilian financial services, retail, and e-commerce organizations since 2024, using phishing, RMM tools, vulnerable servers, and custom malware to gain access to banking and payment systems.