Financial Cybercrime Campaign: "Breeze Comet" Infiltrates Core Payment Systems in Brazil to Execute Mass Fraudulent Transfers
Published: September 2, 2026
Author: Robert Baindourov, DigitalSpying.com
Category: Financial Cybercrime / Threat Intelligence / Payment Security
Tags: Breeze Comet, UNC5669, Mandiant, Google Threat Intelligence, Brazil, PIX Fraud, Banking Trojans
Executive Summary
A sophisticated and financially motivated cybercrime syndicate tracked as Breeze Comet (formerly UNC5669) is actively compromising payment processing infrastructure across Brazilian financial institutions, retail conglomerates, and e-commerce platforms. In an extensive threat intelligence report published on August 31 and September 1, 2026, by the Google Threat Intelligence Group (GTIG) and Mandiant, researchers revealed that Breeze Comet specializes in manipulating core banking software and instant payment protocols to execute hundreds of fraudulent financial transactions.
Active since at least late 2023 and closely overlapping with threat clusters tracked by CrowdStrike as Plump Spider and Trend Micro as SHADOW-AETHER-064, Breeze Comet has demonstrated deep domain knowledge of Brazilian financial architecture, including the Central Bank of Brazil's PIX instant payment system. The group has bypassed traditional banking antifraud controls, diverted transactions worth millions of reais, and successfully laundered stolen funds through domestic money-mule networks.
Deep-Dive Technical Analysis
Initial Access Vectors
Breeze Comet achieves initial access to corporate networks through highly targeted vectors tailored to the Latin American financial ecosystem:
* Targeted Spear-Phishing: Distributing invoice-themed PDFs and fiscal documents containing obfuscated LNK files or malicious Microsoft Office documents.
* Compromised VPN & Remote Access Gateways: Purchasing stolen corporate employee credentials from infostealer logs on dark web marketplaces.
* Abuse of Legitimate RMM Tools: Deploying commercial remote management tools (such as AnyDesk, ScreenConnect, and RemotePC) to establish persistent initial footholds that evade initial endpoint security scrutiny.
Living-off-the-Land & Lateral Movement
Once inside the internal network, Breeze Comet operators conduct thorough reconnaissance to locate servers hosting core banking and payment processing middleware:
* Host Discovery: Utilizing native Windows utilities (net.exe, nltest.exe, and PowerShell) to identify Domain Controllers and dedicated financial servers.
* Privilege Escalation: Exploiting unpatched internal vulnerabilities (Active Directory misconfigurations, Kerberoasting) to acquire domain administrative rights.
* Custom Backdoors: Deploying bespoke Delphi- and Go-based backdoors that establish covert command-and-control (C2) communication over encrypted TLS channels.
Payment Protocol Manipulation & PIX Hijacking
The defining characteristic of Breeze Comet is its deep reverse engineering of banking client applications and payment gateways:
* API Hooking & Process Injection: Injecting dynamic link libraries (DLLs) into legitimate banking client binaries to hook memory functions responsible for transaction construction.
* Transaction Parameter Rewriting: Silently altering the destination bank account (chave PIX), tax ID (CPF/CNPJ), and transaction amount immediately prior to cryptographic signing and transmission to the clearinghouse.
* Bypassing Antifraud Analytics: By executing transactions from authenticated internal workstations during standard business hours and keeping transfer sums below automated threshold triggers, the attackers routinely evade real-time fraud monitoring systems.
Threat Actor Profile & Attributed Ecosystem
* Tracking Names: Breeze Comet (GTIG/Mandiant), UNC5669, Plump Spider (CrowdStrike), SHADOW-AETHER-064 (Trend Micro).
* Motivation: Pure financial extortion and direct treasury diversion.
* Geographic Focus: Brazil, with expanding operations into adjacent Latin American and Iberian financial corridors.
* Mule Networks: Collaborates with localized Brazilian cybercrime syndicates specializing in automated "laranja" (mule) account generation and rapid cryptocurrency conversion.
Industry Recommendations & Defensive Mitigations
1. Transaction Signing & Hardware Cryptography:
Financial institutions must transition to hardware-based cryptographic confirmation (HSMs) and out-of-band transaction signing for internal high-value transfers, ensuring parameters cannot be modified in-memory by compromised endpoints.
2. Application Whitelisting & Endpoint Isolation:
Workstations with direct access to banking portals and payment gateway backends must be strictly isolated on segmented VLANs with application whitelisting (AppLocker / Windows Defender Application Control) enforced to block unauthorized DLL injection and unapproved RMM tools.
3. Behavioral Telemetry on Payment APIs:
Deploy behavioral monitoring on payment APIs to flag anomalous bursts of transfers, unexpected transaction velocity, or modifications to recipient account patterns during active user sessions.
4. Credential Rotation & Phishing-Resistant MFA:
Enforce FIDO2/WebAuthn phishing-resistant multi-factor authentication across all external VPN and corporate SaaS interfaces to neutralize infostealer credential reuse.