BREEZE COMET Targets Brazilian Financial Infrastructure

BREEZE COMET (formerly UNC5669, overlapping with Plump Spider and SHADOW-AETHER-064) is a sophisticated, financially motivated threat actor actively targeting the Brazilian financial sector, including banks, fintechs, and retail organizations. The group's primary objective is to manipulate instant payment systems like Pix and the Brazilian Reserves Transfer System (STR) to conduct fraudulent high-value transfers. Since 2024, they have demonstrated a significant evolution from traditional social engineering to complex, multi-environment intrusions using bespoke malware and AI-supported scripting.

The actor's technical arsenal includes custom backdoors written in Rust, Nim, and Go, alongside compromised Brazilian government infrastructure for malware staging. Notably, BREEZE COMET has begun operationalizing generative AI to compress their development lifecycle, producing verbose but functional scripts for reconnaissance, mass deployment, and credential validation. This maturation indicates a growing threat to interconnected financial ecosystems where the speed of execution is critical.

For organizations in the Latin American region, particularly those integrated with Brazilian financial APIs, this represents a high-priority threat. The group's ability to maintain persistent access via Kubernetes pods, rogue physical hardware, and redundant C2 frameworks necessitates a defense-in-depth approach focusing on network segmentation, mTLS credential protection, and strict application controls.