Breeze Comet talks its way into Brazilian payment systems with a help-desk call and AnyDesk

Google Threat Intelligence Group (GTIG) and Mandiant track a financially motivated actor dubbed Breeze Comet, formerly UNC5669, targeting Brazilian financial services, retail and e-commerce organizations since 2024.

GTIG and Mandiant describe Breeze Comet as "specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers."

The actor is said to have successfully carried out at least one heist of assets worth tens of thousands of U.S. dollars.

Primary targets are organizations with permission to conduct transactions through banking software, APIs and payment systems such as Pix, STR and Boleto, including banks, payment processors, retailers, exchanges, fintech firms and banking software providers.

The actor uses compromised Brazilian small government websites to stage RMM tools, infostealers dressed up as legitimate tax or receipt documents and backdoors such as XWorm, and as C2 endpoints to bypass reputation filters; a similar approach has been replicated across Nigeria, Paraguay, Ghana and Venezuela.

The group has connected rogue hardware devices directly into retail store networks to establish footholds, then downloaded Netcat and custom scripts to retrieve post-exploitation frameworks.

Internal reconnaissance and privilege escalation use Impacket, ADRecon, ADVipscan and a custom LDAP brute-forcing utility called REALBREEZE, targeting development and cloud environments.

Lateral movement uses unauthorized RDP sessions and command execution over SMB shares, and includes deployment of COBALTSPIN, a Rust-based routing malware acting as a network tunneler to maintain persistent access to financial API infrastructure.

Google says COBALTSPIN establishes a reverse SOCKS5 proxy over a WebSocket connection to route traffic between C2 and internal targets, enabling lateral movement through boundary firewalls without built-in persistence mechanisms that might trigger detection.

Breeze Comet has executed hundreds of fraudulent transactions via Brazilian payment systems.

The activity overlaps with clusters tracked by CrowdStrike as Plump Spider and by Trend Micro as SHADOW-AETHER-064.

According to CrowdStrike, the e-crime group operates out of Brazil, has been active since September 2023, and monetizes intrusions by gaining unauthorized access to internal payment systems and carrying out fraudulent transactions.

Google lists four requirements the actor must meet: access to the National Financial System Network (RSFN) through an entity that already has it; mTLS credentials allowing authenticated payloads with transactional orders to Pix or STR; access to several accounts in the target's Active Directory and cloud environments; and an understanding of the organization's transfer processing procedures, network controls, fintech integrations and anti-fraud systems.

Google says Breeze Comet tactics have evolved to leverage a customized malware suite and compromised, trusted websites for initial access, C2, and interaction with financial software and payment APIs.

Google says Breeze Comet's operational infrastructure may indicate intent to expand its infrastructure footprint to other countries in Latin America and Africa.

CrowdStrike's start date for the group precedes the earliest possible month of Google's stated targeting window by at least four months.

Of the two initial access routes documented for Breeze Comet, one requires a vulnerable server and one requires none.

Three of Google's four preconditions for a fraudulent transfer are access or credential requirements and the fourth is procedural knowledge; none require a software vulnerability.