Breeze Comet's Payment System Raids Signal New Fraud Era

For years, financial cybercrime in Latin America was largely a game of volume — high-volume, client-side retail fraud aimed at individual accounts. Now, Google's threat intelligence teams have detailed a shift: a Brazilian e-crime group, tracked as Breeze Comet, has been directly infiltrating the core payment infrastructure of financial institutions and retailers, executing fraudulent transfers that have already netted tens of thousands of dollars in a single heist.

The activity, detailed in a report from Google Threat Intelligence Group (GTIG) and Mandiant, represents a strategic pivot from opportunistic fraud to targeted intrusions into the very systems that move money in Brazil — Pix, STR, and Boleto. The group's methods, which range from social engineering to malware deployment and lateral movement, show a level of sophistication that Google says could serve as a model for future financially motivated threats in the region.

Targeting Brazil's Financial Core

Since at least 2024, Breeze Comet — previously known as UNC5669 — has been zeroing in on Brazilian financial services, retail, and e-commerce organizations. According to Google and Mandiant, the threat actor specializes in manipulating payment systems and banking software to conduct fraudulent transfers. The group has already pulled off at least one heist of assets worth tens of thousands of U.S. dollars, underscoring the real-world impact of these intrusions.

The primary targets are organizations with permission to conduct transactions through banking software, APIs, and payment systems such as Pix, STR, and Boleto. This broadens the scope to include banks, payment processors, retailers, exchanges, and fintech and banking software providers. The goal is to gain access to the National Financial System Network (RSFN) and mTLS credentials, which allow the group to send authenticated payloads with transactional orders to Pix or STR.

To succeed, Breeze Comet must also secure access to several accounts in the targeted organizations' Active Directory and cloud environments, and develop a deep understanding of transfer processing procedures, network controls, fintech integrations, and anti-fraud systems. This is not a smash-and-grab operation; it requires careful planning and extensive reconnaissance.

Social Engineering and Compromised Sites

Initial access is often gained through low-tech means: password spraying and voice calls impersonating IT support teams, persuading targets to install Remote Monitoring and Management (RMM) tools such as AnyDesk. In one case highlighted by Axur in November 2025, the threat actors masqueraded as IT support personnel over a WhatsApp conversation and guided the victim to install a PowerShell reconnaissance script under the pretext of updating a corporate application.

Alternatively, the group has targeted vulnerable JBoss AS servers to deploy web shells, which are then used to deliver additional tooling, including Chisel and other proxy utilities, for follow-on exploitation. They have also been observed using compromised Brazilian small government websites to stage RMM tools, infostealers dressed up as legitimate tax or receipt documents, and backdoors like XWorm, as well as using them as command-and-control (C2) endpoints to bypass reputation filters and avoid detection. This modus operandi has been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus.

Hardware Hacks and Post-Exploitation

Beyond software tricks, Breeze Comet has connected rogue hardware devices directly into retail store networks, establishing a direct foothold and then moving laterally to internal systems. After gaining access, they download the Netcat utility and custom scripts to retrieve post-exploitation frameworks.

For internal reconnaissance and privilege escalation, the group uses tools like Impacket, ADRecon, ADVipscan, and a custom LDAP brute-forcing utility named REALBREEZE, focusing on development and cloud environments. Lateral movement is achieved through unauthorized Remote Desktop Protocol (RDP) sessions and executing commands via SMB network file shares.

The COBALTSPIN Tunnel

A key component of the operation is COBALTSPIN, a Rust-based routing malware that operates as a network tunneler. It establishes a reverse SOCKS5 proxy over a WebSocket connection, routing network traffic between the C2 and internal targets. This enables lateral movement directly through boundary firewalls without requiring built-in persistence mechanisms that might trigger detection. Google said this technique allows the group to maintain persistent network access to financial API infrastructure.

Google's analysis notes, "By establishing a reverse SOCKS5 proxy over a WebSocket connection, COBALTSPIN routes network traffic securely back and forth between the C2 and internal targets, enabling lateral movement directly through boundary firewalls without requiring built-in persistence mechanisms that might trigger detection."

Evolving Persistence and Cloud Secrets

Breeze Comet's persistence mechanisms have evolved over time. In 2024, they relied on commercial RMM tools; a year later, they shifted to deploying malicious Kubernetes pods and stealing cloud secrets by exfiltrating them to public-facing notepad websites like dontpad[.]com.

The group has also developed a suite of custom backdoors to maintain redundant access:

• LIGHTPAINT, a Java-based backdoor that installs the legitimate SoftEther VPN and configures it for automated persistence.
• MILDFROST, a passive Java JAR backdoor used to establish covert DNS tunnels.
• KICKPLATE, a Nim-based backdoor that impersonates Windows Update Health Tools to deliver secondary payloads and run commands to control SOCKS5 tunnelers.
• BOATBEAM, a Golang-based backdoor that initiates a fake IIS HTTPS server on port 443.

To keep these mechanisms hidden, the group executes PowerShell commands to disable Windows Defender's real-time monitoring on compromised hosts.

The Final Heist and Cover-Up

In the final stage, COBALTSPIN and compromised privileged accounts are used to access core financial applications and execute hundreds of fraudulent transactions. Once complete, event logs are cleared to minimize the forensic footprint and conceal API interactions with financial software and payment systems. Any directory created during the intrusion is also deleted.

The malware development shows signs of automation. Google notes the presence of verbose explanatory comments and standardized execution headers, indicating the use of a large language model (LLM) to compress the malware development lifecycle. A previous analysis from Trend Micro in May 2026 also found some scripts to include "descriptions of self-reasoning and autonomous decision-making processes."

Why It Matters

This campaign marks a notable shift in the Latin American cybercrime landscape. As Google states, "While the Latin American cybercrime ecosystem has historically been defined by client-side, high-volume retail fraud, Breeze Comet's campaigns represent a notable shift that may serve as a model for future financially motivated threats against organizations in this region."

This transition from opportunistic retail banking fraud to direct intrusions into the core financial switch and instant payment infrastructure is notable not just for the shift in targeting, but also for the capabilities of the threat actor. As threat groups increasingly leverage LLMs to streamline routine tradecraft, defenders must anticipate shorter adversary turnaround times and heightened pressure on interconnected financial ecosystems. For organizations in Brazil and beyond, this means that securing the perimeter is no longer enough — they must protect the very systems that process their transactions.