Actor Profile

Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026. The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment service Pix, digital asset platforms, and financial entities' cloud environments. Their primary motivation is financial gain through theft of cryptocurrency custody secrets and unauthorized instant payment transfers. The group exhibits sophisticated cloud security awareness and understanding of Brazil's financial ecosystem, specifically targeting credentials associated with high-value digital currency assets.

TTPs (Tactics, Techniques, Procedures)

Slim Spider employs multi-stage cloud-focused intrusions with custom tooling. Key techniques include: developing custom Bash scripts to query cloud instance metadata and steal temporary cloud credentials over socket connections; enumerating secrets stored in cloud credential managers; using 'sed' command to clone and modify secret-extracting scripts; implementing cloud-native cryptographic signing via OpenSSL within Bash scripts to avoid detection; deploying backdoors that mimic infrastructure-related binaries for defense evasion; pivoting to Azure DevOps using compromised credentials to run malicious pipelines; deploying implants across managed Kubernetes clusters; and utilizing web-based automation panels (NEXUS // Scanner for API endpoint reconnaissance, Painel de Emails Entra ID for Microsoft 365 mailbox compromise, and Painel Pix for bulk unauthorized Pix transfers). The group also deploys MikeDor, a Go-based backdoor for information harvesting and user activity monitoring.

Targets & Patterns

Slim Spider exclusively targets Brazilian financial institutions, including banks and fintech organizations. The adversary focuses on entities with cryptocurrency assets, instant payment infrastructure (specifically Pix), and cloud-based financial operations. Targeting patterns indicate the group seeks organizations with digital asset custody capabilities and access to Brazil's Sistema de Pagamentos Instantâneos (SPI) infrastructure. CrowdStrike discovered an exposed C2 panel displaying several compromised hosts from multiple Brazil-based banks and fintech organizations. The targeting is highly specialized, reflecting deep understanding of Brazilian financial regulatory frameworks, payment systems, and cloud architectures used by these institutions. The ultimate objective is access to high-value financial assets, particularly cryptocurrency wallets and instant payment accounts that enable immediate financial theft.

Historical Context

Slim Spider was first documented by CrowdStrike in connection with attacks dating back to at least March 2026, making this a recently emerged threat. The group represents a broader trend in the Latin American cybercrime ecosystem shifting from traditional client-side, high-volume retail fraud to sophisticated direct intrusions into core financial infrastructure. This evolution is exemplified by concurrent activity from another group, Breeze Comet (aka CL-CRI-1163, Plump Spider, SHADOW-AETHER-064), which has targeted Brazilian payment infrastructure since 2024. The targeting of Pix by multiple distinct threat actors indicates the Brazilian instant payment system has become an increasingly lucrative target. Slim Spider's cloud-native approach and operational security sophistication represent a notable advancement in e-crime capabilities, demonstrating that financially motivated actors are adopting techniques previously associated with nation-state APT groups.

Defensive Recommendations

  • Monitor cloud instance metadata service access (169.254.169.254) for unusual queries and implement metadata service protections to prevent credential theft from compute instances
  • Enable comprehensive logging for cloud credential manager access (AWS Secrets Manager, Azure Key Vault, etc.) and alert on bulk secret enumeration or unusual access patterns to custody-related credentials
  • Audit Azure DevOps pipeline execution for unauthorized or modified pipelines, particularly those deploying to Kubernetes clusters, and enforce multi-factor authentication for DevOps platform access
  • Implement behavioral detection for processes mimicking legitimate infrastructure binaries and monitor for suspicious use of 'sed', OpenSSL, and 'cast' (Foundry toolkit) in non-standard contexts
  • Deploy network segmentation between financial transaction systems (Pix, cryptocurrency custody) and general corporate infrastructure, with strict access controls and monitoring for lateral movement to high-value asset environments

---

# Geopolitical Context

Geopolitical Context

The emergence of Slim Spider represents a maturation of Brazil's cybercrime ecosystem, shifting from traditional retail banking fraud toward sophisticated intrusions targeting core financial infrastructure. The adversary's focus on Pix—Brazil's instant payment system launched in 2020 and now the country's dominant payment method—reflects how national digital payment infrastructure has become a strategic target for financially motivated actors. This evolution parallels broader regional trends, with Breeze Comet demonstrating similar capabilities and expanding operations beyond Brazil to other Latin American and African nations. The targeting of cloud-native financial infrastructure and cryptocurrency custody systems indicates that threat actors are adapting to the region's rapid fintech adoption and cloud migration, exploiting the gap between technological modernization and security maturity in emerging market financial institutions.

State Actor Alignment

Slim Spider appears to be a financially motivated cybercrime group with no evident state sponsorship or geopolitical objectives. The actor's Brazil-based operations, deep knowledge of domestic financial systems (particularly Pix infrastructure), and exclusive focus on monetary gain are consistent with organized e-crime rather than state-directed activity. The threat actor's sophisticated cloud tradecraft and operational security—including custom Bash scripts, cloud-native cryptographic implementations, and infrastructure mimicry—suggest professional criminal organization rather than state intelligence collection. No sanctions designations, government attributions, or connections to state-aligned cyber programs have been reported. The parallel emergence of Breeze Comet with similar targeting patterns may indicate a broader professionalization of Latin American financially motivated threat actors, though no formal coordination between groups has been established.

Business Impacty pro region

For Latin America, Slim Spider's operations highlight vulnerabilities in the region's rapidly expanding digital financial infrastructure, particularly instant payment systems that have achieved mass adoption ahead of comprehensive security frameworks. Brazil's Pix system—processing over 40 billion transactions annually—represents critical national financial infrastructure whose compromise could undermine public confidence in digital payments and fintech innovation. The threat actor's successful exploitation of cloud environments at financial institutions suggests systemic security gaps across Brazil's banking and fintech sectors, potentially affecting regional financial stability. Breeze Comet's expansion into Paraguay, Venezuela, and West African nations (Nigeria, Ghana) demonstrates that successful tactics developed against Brazilian targets are being exported, threatening financial infrastructure across emerging markets. For global financial institutions with Brazilian operations or cryptocurrency exposure, these campaigns illustrate the convergence of traditional banking fraud, cloud exploitation, and digital asset theft. European and North American financial services firms operating in or partnering with Latin American entities face increased third-party risk from sophisticated regional threat actors targeting cross-border payment rails and shared cloud infrastructure.

Forecast

If Brazilian financial institutions do not rapidly enhance cloud security controls and credential management practices, Slim Spider and similar actors are likely to continue successful compromises of cryptocurrency custody systems and instant payment infrastructure throughout 2026-2027. The threat actor's demonstrated capability to extract cloud secrets, deploy Kubernetes implants, and automate reconnaissance through custom panels suggests ongoing operations are probable. If Breeze Comet's regional expansion model proves successful, other Brazilian cybercrime groups may replicate Slim Spider's cloud-focused tactics beyond Brazil, targeting fintech and banking infrastructure across Latin America, Africa, and potentially other emerging markets with rapidly adopted digital payment systems. Should cryptocurrency custody breaches result in significant financial losses, Brazilian regulators may impose stricter security requirements on digital asset platforms and cloud deployments, potentially accelerating security maturation but also increasing compliance costs for regional financial institutions. If law enforcement coordination between Brazilian authorities and international partners intensifies, disruption operations against command-and-control infrastructure and arrest activity targeting Brazil-based threat actors may increase in the coming months, though the decentralized nature of these cybercrime operations suggests attribution and prosecution will remain challenging.