BREEZE COMET: Brazilian Payment Systems Targeted by Financially Motivated Hackers Using Custom Malware

Google Threat Intelligence Group (GTIG) has detailed a threat actor it tracks as BREEZE COMET, formerly UNC5669. Beginning in 2024, Mandiant investigated a string of compromises affecting Brazilian financial services, retail and eCommerce organisations. The group is financially motivated and specialises in manipulating payment systems and banking software to conduct fraudulent transfers. Its activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064.

According to GTIG, the group's methods have evolved over time. It now uses a customised malware suite and compromised, trusted websites for initial access, command and control, and to interact with financial software and payment APIs. Its targets are organisations with permission to carry out transactions through banking software, APIs and payment systems such as Pix, STR and Boleto. These include banks, payment processors, retailers, exchanges, and fintech and banking software providers.

GTIG also notes two signs that the threat may grow. The group's infrastructure may indicate intent to expand to other countries in Latin America and Africa, and there is evidence it is using generative AI to support malware development, which could increase the scale, speed and sophistication of its operations. To succeed, the group needs persistent access to multiple accounts in a target's Active Directory or cloud environments, and an understanding of the organisation's transfer procedures, network controls and anti-fraud systems. This summary covers only the opening of GTIG's report, which also includes mitigation advice and detections.