Breeze Comet threat actor targets Brazilian financial sector with sophisticated attacks

Brazilian financial services, retail, and e-commerce organizations have been targeted by a financially motivated threat actor known as Breeze Comet, formerly UNC5669, since 2024, according to a report by Google Threat Intelligence Group. This group specializes in manipulating payment systems and banking software within Brazil to conduct fraudulent transfers, and has successfully executed at least one heist of tens of thousands of U.S. dollars, with further coverage provided by The Hacker News.

Breeze Comet gains initial access through password spraying and social engineering tactics, impersonating IT support to trick victims into installing Remote Monitoring and Management (RMM) tools like AnyDesk or PowerShell scripts. They also exploit vulnerable JBoss AS servers to deploy web shells for further exploitation. The primary targets are entities with access to banking software, APIs, and payment systems such as Pix, STR, and Boleto, including banks, payment processors, retailers, and fintech providers. The actor leverages compromised government websites and rogue hardware devices for staging tools and establishing network footholds.

Internal reconnaissance is performed using tools like Impacket and custom utilities, followed by lateral movement via RDP and SMB. Persistence is achieved through custom backdoors like LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM, and by disabling Windows Defender. The final stage involves using compromised accounts and tools like COBALTSPIN to execute fraudulent transactions and clear logs. The use of LLMs is suspected to accelerate malware development, indicating a potential shift in cybercrime tactics in the region.

Source: The Hacker News