# BREEZE COMET (ex-UNC5669) Targets Brazilian Financial Infrastructure with AI-Assisted Custom Malware Suite

> Google Threat Intelligence Group (GTIG) and Mandiant document BREEZE COMET (formerly UNC5669 / Plump Spider), a financially motivated actor that evolved from opportunistic Brazilian retail banking fraud into direct intrusions of core financial-switch and instant-payment (Pix/STR/Boleto) infrastructure. The group deploys a custom multi-language backdoor suite and shows evidence of generative-AI-accelerated malware and script development, with a confirmed heist of tens of thousands of USD and hundreds of fraudulent transactions within 24-48 hours of access.

- **Published:** 2026-09-01T00:00:00Z
- **Last reviewed:** 2026-09-02T13:41:02.774Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2266
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-breeze-comet-brazilian-financial-apt-tl-2026-2266.webp?v=74953036 (Threadlinqs threat intel: BREEZE COMET Brazilian Finance APT: Detection & IOCs (TL-2026-2266) — Critical severity, 32 IOCs, 9 detection rules.)
- **ID:** TL-2026-2266
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** BREEZE COMET
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

BREEZE COMET, tracked since at least September 2023 by CrowdStrike as PLUMP SPIDER (community ID SHADOW-AETHER-064) and since 2024 by Mandiant as UNC5669, is a financially motivated cybercriminal syndicate that has shifted its targeting from opportunistic, client-side Brazilian retail-banking fraud toward direct, hands-on-keyboard intrusions into the core systems that process Brazil's national instant-payment rails: Pix, the STR interbank transfer system, and Boleto billing, reached via the RSFN national financial-sector network and mTLS-authenticated payment APIs.

Initial access has evolved from 2024-era password spraying and voice-phishing (vishing) calls that impersonate IT support to convince staff to install remote monitoring and management (RMM) tools such as AnyDesk, to 2025-era techniques including rogue physical hardware implants inserted directly into retail store networks to gain a lateral-movement foothold, exploitation of JBoss Application Server vulnerabilities (specific CVE not disclosed by researchers), and attempted insider recruitment (corroborated by Axur). From mid-2025 the group began staging payloads and command-and-control on compromised Brazilian municipal government websites, which bypasses network domain-reputation filtering; the same technique has since been replicated on government domains in Nigeria, Guinea, Paraguay, and Venezuela, signaling geographic expansion beyond Brazil.

The group's 2025-2026 toolset is a custom, redundant, multi-language backdoor suite: COBALTSPIN (Rust) is a lightweight tunneler that opens a reverse SOCKS5 proxy over WebSocket to bridge C2 traffic into segmented financial networks; REALBREEZE is a custom LDAP brute-forcing utility used for Active Directory and cloud credential validation; LIGHTPAINT (Java) installs and silently persists a SoftEther VPN client, opening inbound Windows Defender Firewall rules and clearing 'Windows Networking Vpn Plugin Platform' event logs to erase forensic evidence; MILDFROST is a passive Java JAR backdoor that hides in JVM process space and falls back to a slow, covert DNS tunnel (via a class named DnsCommandBeacon) to fetch fresh native payloads; KICKPLATE (Nim) impersonates Windows Update Health Tools, abuses scheduled tasks (schtasks.exe as SYSTEM) and registry run keys, and modifies Windows services and startup .lnk shortcuts for persistence; BOATBEAM (Go) runs a fake IIS HTTPS listener on port 443 that only activates C2 functionality when it receives a specific session cookie, giving the actor a redundant, low-visibility channel. XWORM, a widely available commercial/cracked RAT, is used as an initial-access payload disguised as tax/receipt documents (e.g. ComprovantePDF.exe) staged on the compromised government sites.

Once inside, the actor uses Impacket, ADRecon, ADVipscan, and AI-assisted custom reconnaissance scripts to enumerate SMB pathways, hijack service accounts for RDP and SMB lateral movement, and search hosts and environment variables for terms such as boleto, cnab, remessa, and webhook/instant-payment references, hunting for mTLS credentials, administrative certificates, CI/CD pipeline credentials, cloud access tokens, and Kubernetes secrets (exfiltrated via the public paste site dontpad.com). Mandiant identified direct evidence that large language models accelerated development of the actor's reconnaissance, credential-validation, mass-deployment, and data-extraction scripts: the AI-authored code is described as highly functional but lacking human idiosyncrasies, heavily reliant on unrolled logic, verbose explanatory comments, and standardized execution headers.

Once access to financial-switch/payment infrastructure is achieved, the actor executes two waves of hundreds of fraudulent transactions within 24-48 hours, with at least one confirmed heist netting tens of thousands of USD, before clearing event logs and deleting compromise artifacts. GTIG/Mandiant assess BREEZE COMET represents a template for future financially motivated threats against Latin American financial infrastructure and a shift from high-volume client-side retail fraud toward direct compromise of core financial-switch systems.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.004 Phishing: Spearphishing Voice
- T1204.002 User Execution: Malicious File
- T1547.001 Registry Run Keys / Startup Folder
- T1547.009 Boot or Logon Autostart Execution: Shortcut Modification
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1543.003 Create or Modify System Process: Windows Service
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1036 Masquerading
- T1110.003 Brute Force: Password Spraying
- T1087 Account Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1572 Protocol Tunneling
- T1071.004 Application Layer Protocol: DNS
- T1071.001 Application Layer Protocol: Web Protocols
- T1219 Remote Access Tools
- T1657 Financial Theft
- T1200 Hardware Additions
- T1078 Valid Accounts
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1610 Deploy Container
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1562.001 Impair Defenses: Disable or Modify Tools
- T1070.001 Indicator Removal: Clear Windows Event Logs
- T1110 Brute Force
- T1552.001 Unsecured Credentials: Credentials In Files
- T1087.002 Account Discovery: Domain Account

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**KICKPLATE Persistence — Fake Windows Update Health Tools Scheduled Task/Service** (`TL-2026-2266-SPL-002`)

Detects KICKPLATE (Nim backdoor) persistence mechanics: impersonation of the legitimate 'Windows Update Health Tools' naming, creation of a SYSTEM-context scheduled task via schtasks.exe, a registry Run key, and a Windows service, matching BREEZE COMET's 2026 custom-backdoor-suite persistence stage.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1547.001, T1543.003
- **Data sources:** sysmon, device_process_events, device_registry_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=1 Image="*\\schtasks.exe" CommandLine="*create*" (CommandLine="*UpdateHealthTools*" OR CommandLine="*WindowsUpdateHealth*") CommandLine="*/ru*SYSTEM*")
OR (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\*" (TargetObject="*UpdateHealth*" OR Details="*UpdateHealthTools*"))
OR (EventCode=1 Image="*\\sc.exe" CommandLine="*create*" CommandLine="*UpdateHealthTools*")
| eval technique=case(match(_raw,"schtasks"),"T1053.005", match(_raw,"CurrentVersion\\Run"),"T1547.001", match(_raw,"sc.exe"),"T1543.003")
| stats count values(technique) as techniques values(CommandLine) as commandlines by host, User, _time
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "schtasks.exe" and ProcessCommandLine has "/create" and (ProcessCommandLine has "UpdateHealthTools" or ProcessCommandLine has "WindowsUpdateHealth") and ProcessCommandLine has "SYSTEM")
   or (FileName =~ "sc.exe" and ProcessCommandLine has "create" and ProcessCommandLine has "UpdateHealthTools")
| union (
    DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where RegistryKey has @"CurrentVersion\Run" and (RegistryValueName has "UpdateHealth" or RegistryValueData has "UpdateHealthTools")
  )
| project Timestamp, DeviceName, InitiatingProcessAccountName, ActionType, FileName, ProcessCommandLine, RegistryKey, RegistryValueData
```

### Sigma

```yaml
title: KICKPLATE-style Persistence via Fake Windows Update Health Tools
id: d4b7c9f2-6e1a-4d83-9b57-3f0a2c6e8d94
status: experimental
description: Detects scheduled task, registry Run key, or service creation that impersonates 'Windows Update Health Tools', matching the KICKPLATE (Nim) backdoor's persistence mechanism used by BREEZE COMET.
references:
  - https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/
  - https://attack.mitre.org/techniques/T1053/005/
  - https://attack.mitre.org/techniques/T1547/001/
  - https://attack.mitre.org/techniques/T1543/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-01
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.t1547.001
  - attack.t1543.003
  - attack.tool.kickplate
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: 'create'
    CommandLine|contains:
      - 'UpdateHealthTools'
      - 'WindowsUpdateHealth'
  selection_sc:
    Image|endswith: '\sc.exe'
    CommandLine|contains:
      - 'create'
      - 'UpdateHealthTools'
  condition: selection_schtasks or selection_sc
falsepositives:
  - Genuine Microsoft Windows Update Health Tools deployment/repair operations (verify binary signature and install path against C:\Program Files\Microsoft Update Health Tools\)
level: high
```

**Known false positives:**

- Legitimate Microsoft Update Health Tools installation or repair (validate digital signature and install path under Program Files)

**Tuning notes:** Baseline the org's genuine Windows Update Health Tools install path/signature and suppress matches from that exact binary; alert with higher severity when the task/service/run-key creation follows a XWORM or AnyDesk-chain execution (correlate with TL-2026-2266-KQL-001/SIG-001) within the same host session.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vishing-Driven AnyDesk RMM Installation Preceding XWORM Execution (locked: unlock with TL Creds)
- REALBREEZE-style LDAP Brute Force with Account and Remote System Discovery (locked: unlock with TL Creds)
- MILDFROST DNS-Tunnel Fallback C2 and BOATBEAM Cookie-Gated Fake-IIS Beacon (locked: unlock with TL Creds)
- XWORM RAT Masquerading as [indicator] Payment Receipt (locked: unlock with TL Creds)
- LIGHTPAINT SoftEther VPN Persistence with Firewall Rule Add and Event Log Clearing (locked: unlock with TL Creds)
- Fraudulent Pix/STR/Boleto Transaction Burst with [indicator] Secret Exfiltration (locked: unlock with TL Creds)
- JBoss Application Server Exploitation Attempt (BREEZE COMET Initial Access) (locked: unlock with TL Creds)
- COBALTSPIN Reverse SOCKS5-over-WebSocket Tunnel Enabling RDP/SMB Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- Domain: `procon[.]go[.]gov[.]br`
- File hash: `3b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceec`
- Domain: `cmgovernadorluizrocha[.]ma[.]gov[.]br`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Financially Motivated Threat Actor BREEZE COMET Targets Brazil](https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/)
- [Updated Cyber Threat Actor Naming System](https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system)
- [PLUMP SPIDER Adversary Profile](https://www.crowdstrike.com/en-us/adversaries/plump-spider/)
- [BREEZE COMET Threat Actor Attacks Brazilian Banks](https://securityonline.info/breeze-comet-threat-actor-attacks/)
- [Financially Motivated Threat Actor Targets Brazil - Live Threat Radar](https://radar.offseq.com/threat/financially-motivated-threat-actor-targets-brazil-c7f1d34655c9edaf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2266