# The Breeze Comet Cybercampaign: Unpacking the Shift in Financial Threat Tactics
Over the past two years, a financially driven cybercriminal group known as Breeze Comet has increasingly focused its efforts on Brazil’s financial services, retail, and e-commerce sectors. Operating since 2024, this adversary specializes in manipulating payment infrastructures and banking software to execute large-scale fraudulent transfers, having successfully siphoned assets worth tens of thousands of dollars in at least one documented operation. The group’s activities overlap with threat clusters previously tracked by other cybersecurity firms under the names Plump Spider and SHADOW-AETHER-064.
## Initial Access and Deployment Strategies
Gaining entry into these highly regulated organizations typically requires bypassing robust security measures through a combination of technical and social engineering tactics. Attackers frequently employ password spraying campaigns combined with voice-based social engineering, impersonating internal IT support teams to convince employees to install Remote Monitoring and Management (RMM) tools like AnyDesk.
In one notable incident, malicious actors posed as technical support personnel over messaging platforms, tricking victims into executing PowerShell reconnaissance scripts disguised as corporate software updates. Alternatively, the group has targeted vulnerable JBoss Application Server instances, deploying web shells that subsequently deliver proxy utilities and other tooling to facilitate deeper network penetration.
## Targets and Operational Prerequisites
The primary targets for this group are organizations with direct authorization to conduct transactions through Brazilian financial systems, including Pix, STR, and Boleto. This encompasses banks, payment processors, retailers, exchanges, and fintech software providers.
To successfully execute their schemes, the threat actors must meet several critical prerequisites. They must secure access to the National Financial System Network (RSFN) through an already-compromised entity, obtain mutual TLS (mTLS) credentials to send authenticated payloads for transaction orders, and establish footholds within the target’s Active Directory and cloud environments. Additionally, a thorough understanding of the organization’s transfer processing procedures, network controls, fintech integrations, and anti-fraud systems is essential for their operations.
## Tactical Execution and Infrastructure
Once inside the network, the group employs a wide array of advanced techniques. They frequently compromise legitimate Brazilian small government websites to stage malicious payloads, effectively using these trusted domains to bypass reputation filters and establish command-and-control (C2) channels. This modus operandi has also been replicated across Nigeria, Paraguay, Ghana, and Venezuela, indicating a growing targeting focus.
In retail environments, the actors have connected rogue hardware directly into store networks, establishing a direct foothold before moving laterally using tools like Netcat and custom scripts. For internal reconnaissance and privilege escalation, they leverage open-source frameworks such as Impacket, ADRecon, and ADVipscan, alongside a custom LDAP brute-forcing utility known as REALBREEZE.
Lateral movement is often achieved by initiating unauthorized Remote Desktop Protocol (RDP) sessions and executing commands through Server Message Block (SMB) network shares. A pivotal component of their toolkit is COBALTSPIN, a Rust-based routing malware that establishes a reverse SOCKS5 proxy over a WebSocket connection. This enables the attackers to route network traffic securely through boundary firewalls, facilitating lateral movement directly into financial infrastructure without requiring built-in persistence mechanisms that might trigger detection.
## Persistence, Evasion, and The Final Heist
The threat actor’s persistence mechanisms have evolved significantly over time. After initially relying on commercial RMM tools in 2024, the group shifted to deploying malicious Kubernetes pods a year later and exfiltrating cloud secrets to public-facing notepad websites. To maintain redundant access, they deploy a suite of custom backdoors, including LIGHTPAINT (Java-based, configuring SoftEther VPN for automated persistence), MILDFROST (a passive Java JAR establishing covert DNS tunnels), KICKPLATE (a Nim-based backdoor disguised as Windows Update Health Tools), and BOATBEAM (a Golang-based backdoor launching a fake IIS HTTPS server).
To ensure these mechanisms remain undetected, attackers routinely execute PowerShell commands to disable Windows Defender’s real-time monitoring on compromised hosts.
The culmination of these intrusions involves using COBALTSPIN and compromised privileged accounts to access core financial applications and execute hundreds of fraudulent transactions. Post-operation, the actors meticulously clear event logs, remove API interaction traces, and delete any directories created during the intrusion to minimize the forensic footprint.
## The Role of AI in Accelerating Attacks
Notably, the malware itself shows signs of being developed with the assistance of large language models (LLMs). The code features verbose explanatory comments and standardized execution headers designed to compress the malware development lifecycle. Some scripts include descriptions of self-reasoning and autonomous decision-making processes, signaling a broader trend of AI-assisted cybercrime that shortens the adversary’s turnaround time.
***
## Frequently Asked Questions (FAQ)
**Q: What other names is Breeze Comet known by?**
A: The group’s activities overlap with threat clusters tracked by other cybersecurity entities as Plump Spider and SHADOW-AETHER-064.
**Q: How do attackers initially gain access to these networks?**
A: Common initial access vectors include password spraying, voice phishing (vishing) to install RMM tools like AnyDesk, and exploiting vulnerable JBoss servers to deploy web shells and proxy utilities.
**Q: What are the key financial systems targeted by this group?**
A: The group primarily targets systems that process Pix, STR, and Boleto transactions, along with the underlying banking APIs and payment infrastructure used by financial institutions and retailers.
**Q: What is COBALTSPIN and why is it significant?**
A: COBALTSPIN is a custom Rust-based routing malware that creates a reverse SOCKS5 proxy over a WebSocket connection. It is significant because it allows attackers to bypass firewalls and move laterally without relying on traditional persistence methods that security tools might detect.
**Q: How is artificial intelligence being used in these attacks?**
A: Intelligence indicates that large language models are being used to accelerate malware development, evidenced by standardized code headers and self-reasoning scripts that streamline routine tradecraft and shorten attack cycles.
***
## Conclusion
The emergence of Breeze Comet signals a critical maturation in the tactics of financially motivated cybercriminals operating in Latin America. By shifting from opportunistic retail fraud to sophisticated, direct intrusions into national financial infrastructure, this group poses a severe and growing threat to interconnected financial ecosystems. As threat actors continue to adopt AI-driven development and exploit the deep integration of payment systems, organizations must anticipate faster attack cycles and more persistent, stealthy intrusions. Defenders in the financial sector must urgently bolster internal network segmentation, enhance monitoring for anomalous API interactions, and prepare for the reality that traditional boundary defenses are no longer sufficient against such highly resourced and adaptive adversaries.
Thank you for reading
