Actor Profile

Breeze Comet (formerly UNC5669, overlaps with Plump Spider and SHADOW-AETHER-064) is a financially motivated threat actor operating out of Brazil since September 2023. The group specializes in manipulating payment systems and banking software to conduct fraudulent transfers, successfully executing at least one heist worth tens of thousands of U.S. dollars. Their operations target organizations with access to Brazilian payment systems including Pix, STR, and Boleto, requiring sophisticated understanding of National Financial System Network (RSFN) access, mTLS credentials, Active Directory environments, and organizational transfer processing procedures.

TTPs (Tactics, Techniques, Procedures)

Initial access via password spraying and social engineering (impersonating IT support via voice calls and WhatsApp to deploy RMM tools like AnyDesk), exploitation of vulnerable JBoss AS servers to deploy web shells, and physical insertion of rogue hardware into retail networks. Internal reconnaissance using Impacket, ADRecon, ADVipscan, and custom LDAP brute-forcing tool REALBREEZE. Lateral movement via unauthorized RDP sessions and SMB file shares. Deploys custom malware suite including COBALTSPIN (Rust-based SOCKS5 proxy over WebSocket), LIGHTPAINT (Java backdoor installing SoftEther VPN), MILDFROST (passive DNS tunnel backdoor), KICKPLATE (Nim backdoor), and BOATBEAM (Golang fake IIS server). Persistence via malicious Kubernetes pods, cloud secret theft to public notepad sites, and disabling Windows Defender. Uses compromised Brazilian government websites for C2 and staging. Clears event logs post-exploitation to minimize forensic footprint.

Targets & Patterns

Primary targets are Brazilian financial services, retail, and e-commerce organizations with permission to conduct transactions through banking software, APIs, and payment systems (Pix, STR, Boleto). This includes banks, payment processors, retailers, exchanges, fintech providers, and banking software vendors. The actor requires victims to have access to the National Financial System Network (RSFN) and mTLS credentials for authenticated payment transactions. Infrastructure analysis indicates potential expansion into other Latin American countries (Paraguay, Venezuela) and African nations (Nigeria, Ghana), with compromised websites in these regions already being used for staging and C2 operations. The targeting pattern reflects focus on entities with direct access to financial transaction infrastructure rather than end consumers.

Historical Context

Breeze Comet has been active since September 2023 under the designation UNC5669, with activity overlapping clusters tracked as Plump Spider (CrowdStrike) and SHADOW-AETHER-064 (Trend Micro). The group's tactics have evolved significantly from 2024 to 2025: initial operations relied on commercial RMM tools for persistence, but by 2025 the actor developed a sophisticated custom malware suite and began deploying malicious Kubernetes pods. An Axur report from November 2025 documented their social engineering techniques via WhatsApp. Google Threat Intelligence Group and Mandiant tracking indicates the campaign has resulted in hundreds of fraudulent transactions across Brazilian payment systems since 2024, with infrastructure expansion suggesting growing ambitions beyond Brazil into broader Latin American and African markets.

Defensive Recommendations

  • Monitor for unauthorized RMM tool installations (AnyDesk, SoftEther VPN) and implement application whitelisting to prevent execution of unapproved remote access software
  • Detect password spraying attempts through failed authentication log analysis and implement account lockout policies with MFA enforcement for all privileged accounts accessing financial systems
  • Scan for and patch vulnerable JBoss AS servers; monitor web server directories for unauthorized web shell deployment and unusual child processes
  • Implement network segmentation to isolate financial API infrastructure and payment system access; monitor for unauthorized SOCKS5 proxy traffic and WebSocket connections to external endpoints
  • Detect PowerShell commands disabling Windows Defender real-time monitoring (Set-MpPreference -DisableRealtimeMonitoring); monitor for suspicious Kubernetes pod creation and cloud secret access patterns
  • Establish behavioral analytics for financial transaction systems to detect anomalous bulk transfer patterns; implement strict mTLS certificate management and rotation policies
  • Monitor for connections to compromised Brazilian government websites and public notepad services (dontpad[.]com); inspect for rogue hardware devices connected to internal networks
  • Enable enhanced logging for RDP sessions, SMB file share access, and Active Directory enumeration tools (Impacket, ADRecon); alert on event log clearing activities

---

# Geopolitical Context

Geopolitical Context

Breeze Comet represents an evolution in financially motivated cybercrime targeting Brazil's digital payment infrastructure, particularly the Pix instant payment system and national financial networks. Operating since 2024, the group demonstrates sophisticated understanding of Brazil's financial ecosystem, including the National Financial System Network (RSFN) and mTLS authentication protocols. The campaign reflects broader challenges facing Latin American economies as they rapidly digitize financial services: while systems like Pix have driven financial inclusion and economic efficiency, they have also created concentrated attack surfaces for technically proficient domestic threat actors. The group's operational pattern—leveraging compromised government websites, social engineering via WhatsApp, and physical hardware insertion into retail networks—indicates adaptation to Brazil's specific technological and social landscape. Evidence of infrastructure expansion into Nigeria, Paraguay, Ghana, and Venezuela suggests potential scaling of tactics across emerging markets with similar payment modernization trajectories, though this remains nascent.

State Actor Alignment

Breeze Comet (also tracked as UNC5669, Plump Spider, and SHADOW-AETHER-064) is assessed by CrowdStrike and Google Threat Intelligence as a financially motivated cybercriminal group operating from Brazil with no apparent state sponsorship. The group's targeting is economically driven rather than geopolitically motivated, focusing on direct financial theft through payment system manipulation. Their compromise of Brazilian government websites for infrastructure purposes appears opportunistic rather than coordinated with state interests. The threat actor's activities do not align with known Brazilian state cyber priorities, which have historically focused on sovereignty, critical infrastructure protection, and regional diplomatic positioning. No sanctions designations or formal government attributions have been issued against this group. The expansion of staging infrastructure to African and Latin American countries may indicate criminal network growth but does not suggest state backing or strategic intelligence objectives.

Business Impacty pro region

The Breeze Comet campaign has direct implications for Brazil's financial sector and broader Latin American economic security. Brazil's Pix system, launched in 2020, processes over 3 billion transactions monthly and has become critical national infrastructure; successful exploitation undermines confidence in digital payment modernization efforts across the region. The compromise of banks, payment processors, retailers, and fintech providers creates systemic risk within Brazil's interconnected financial ecosystem. For Latin America broadly, the campaign signals that rapid fintech adoption without commensurate security maturation creates exploitable vulnerabilities. The threat actor's apparent reconnaissance in Paraguay and Venezuela, and use of infrastructure in Nigeria and Ghana, suggests potential export of Brazilian-refined tactics to other emerging markets undergoing payment system digitization. European and North American financial institutions with Brazilian operations or partnerships face indirect exposure through supply chain and integration points. The campaign also highlights challenges for international cybersecurity cooperation: while technically sophisticated, the purely criminal nature and domestic Brazilian origin may limit cross-border law enforcement coordination compared to state-sponsored threats.

Forecast

If Breeze Comet continues to successfully monetize intrusions within Brazil's payment infrastructure, the group is likely to refine its custom malware suite (COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM) and expand operations to additional financial entities within Brazil. Should Brazilian financial institutions and regulators implement enhanced monitoring of mTLS credential usage, Active Directory anomalies, and API transaction patterns, the group may shift toward longer dwell times and more sophisticated anti-forensic techniques. If infrastructure observed in Paraguay, Venezuela, Nigeria, and Ghana becomes operationally active, similar campaigns targeting Pix-equivalent systems (such as Paraguay's Sipap or Nigeria's efforts toward instant payment modernization) could emerge within 12-18 months, though this depends on the group's ability to acquire equivalent insider knowledge of those systems. Increased attention from Brazilian Federal Police and international cybercrime task forces may drive the group toward more distributed operations or partnerships with established cybercriminal networks. If successful heists continue to yield tens of thousands of dollars per incident with limited law enforcement consequences, copycat groups within Brazil's cybercriminal ecosystem are likely to adopt similar tactics, potentially creating a sustained threat to regional payment infrastructure through 2027.