TLDR Tech / InfoSec
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Since 2024, the financially motivated threat actor BREEZE COMET has targeted Brazilian financial institutions, including banks, payment firms, retailers, exchanges, and fintech providers, to conduct fraudulent Pix, STR, and Boleto transfers. Their initial access methods include password spraying, fake IT-support calls, malicious tax files, exploiting exposed JBoss servers, and compromising rogue devices on retail networks. The group exfiltrates mTLS credentials, API keys, CI/CD secrets, and cloud tokens, then uses SMB and RDP for lateral movement. Their extensive toolkit comprises REALBREEZE, COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM. Mandiant observed transaction waves occurring within 24-48 hours of gaining access to core financial applications.
Read the full story