Financially Motivated Threat Actor BREEZE COMET Targets Brazil

What it is

BREEZE COMET (formerly UNC5669; overlaps with Plump Spider and SHADOW-AETHER-064) is a financially motivated actor that Mandiant and GTIG have tracked since 2024. It breaks into organizations that can send Pix, STR and Boleto transactions, then uses stolen mTLS credentials to submit fraudulent transfers in the victim's name. In one incident, two waves of hundreds of fraudulent transactions came within 24 to 48 hours of access to core financial applications. The page reports at least one heist of tens of thousands of USD.

How it works

Access to the financial network (RSFN), mTLS credentials and persistent AD or cloud accounts are what the actor needs. Observed steps:

• Initial access: password spraying, calls posing as IT support to get AnyDesk installed, and rogue hardware plugged into retail store networks (first seen 2025). From mid-2025, compromised small Brazilian government sites hosted RMM tools, fake receipt infostealers (ComprovantePDF.exe) and XWORM, and served as C2. Municipal domains in Nigeria, Paraguay, Ghana and Venezuela were used the same way. Trend Micro reports JBoss AS exploitation, and Axur reports insider recruitment attempts.
• Credential hunting: Impacket, ADRecon and ADVipscan run in memory via PowerShell, plus the custom LDAP brute-forcer REALBREEZE. The actor mines CI/CD for hard-coded pipeline credentials, API keys and cloud tokens. Scripts search hosts and environment variables for the terms boleto, cnab, remessa, webhook.pix and instant.payment.
• Lateral movement: hijacked service accounts for RDP, command execution over SMB shares, and COBALTSPIN, a Rust reverse SOCKS5 proxy over WebSocket with no built-in persistence.
• Persistence: malicious Kubernetes pods that send cloud secrets to public notepad sites such as dontpad[.]com. Backdoors:
• LIGHTPAINT (Java) installs SoftEther VPN, adds inbound Defender Firewall rules and clears the Windows Networking Vpn Plugin Platform logs.
• MILDFROST (Java JAR) tunnels over DNS and is a fallback C2.
• KICKPLATE (Nim) poses as Windows Update Health Tools and edits startup keys and services. The actor also uses schtasks.exe as SYSTEM and .lnk edits in startup folders.
• BOATBEAM (Go) runs a fake IIS HTTPS server on port 443 and activates only on a specific session cookie.
• Defense evasion: Set-MpPreference -DisableRealtimeMonitoring $true, then event log clearing and deletion of created directories after the fraud.
• LLM use: recovered scripts show verbose comments, unrolled code and standard headers, consistent with LLM generation. Mandiant says they were used for recon, credential validation, mass deployment, pivoting and data extraction.

What to do

The page's hardening advice:

• Block execution from user-writable paths with application control (WDAC, Gatekeeper, fapolicyd). Mount /tmp and /home noexec on Linux. Alert on portable RMM execution and unapproved service registrations.
• At branches and stores, use 802.1X NAC, disable unused switch ports, enforce MAC limiting and restrict access to networking closets.
• Alert on volume shadow copy creation or deletion and restrict ntdsutil.exe and vssadmin.exe. Enable PowerShell Constrained Language Mode, Script Block Logging (Event ID 4104) and AMSI. Require phishing-resistant MFA and lockout on external portals.
• Inspect outbound TLS instead of trusting domain reputation or .gov allowlists. Block non-essential egress including ICMP, restrict tunnelers such as Chisel and GSocket, and segment SMB (445) and RDP (3389) between workstations and servers.
• In Kubernetes, use least-privilege RBAC, block privileged containers with OPA Gatekeeper, Kyverno or Pod Security Admission, and apply egress policies that block public platforms.
• Use a central secrets manager (for example HashiCorp Vault) with access logging, Layer 7 micro-segmentation for financial workloads, and PAM-controlled jump hosts for admin access.

Detections: Google SecOps rules "Network DNS Connections To Pastebin", "Powershell Downloadstring Method With Suspicious Arguments" and "Powershell Loading Net Assembly" (Mandiant Hunting Rules pack). The page gives YARA rules M_Utility_REALBREEZE_2, G_Tunneler_COBALTSPIN_1, G_Backdoor_BOATBEAM_1 and G_Backdoor_MILDFROST_1. The MILDFROST rule matches 7 of 9 command strings, such as "shell:", "exec:", "upload," and "noop". IOCs are in a GTI Collection for registered users, not in the page text.

Caveats

The page has no YARA rule for LIGHTPAINT or KICKPLATE. The SecOps rules named are broad, not specific to this actor. The COBALTSPIN and BOATBEAM rules depend on code at fixed file offsets, so they may match only particular builds. The claim of expansion to Latin America and Africa rests on infrastructure and municipal domain reuse, which the page calls a possible intent.