Threat reportThreat IntelligenceTL-2026-4200
BREEZE COMET (formerly UNC5669) - Financially Motivated Actor Targeting Brazilian Payment Systems and Banking Software
BREEZE COMET (formerly UNC5669) (TL-2026-4200), also tracked as UNC5669, is a high-severity tracked intrusion set, first published 2026-10-23. It is attributed to BREEZE COMET with medium confidence, affects Various Brazilian financial-sector payment infrastructure (Pix, maps to 24 MITRE ATT&CK techniques (T1003.003, T1021.001, T1021.002), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 1BREEZE COMET
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4200
- Threat ID
- TL-2026-4200
- Also known as
- UNC5669, Plump Spider, SHADOW-AETHER-064
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- BREEZE COMET
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, payment-processing, fintech, cryptocurrency, retail, government administration
- Target regions
- brazil, Latin America, Africa
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in BREEZE COMET (formerly UNC5669)
Malware and tooling: AnyDesk, XWorm
How BREEZE COMET (formerly UNC5669) works
Google Threat Intelligence Group and Mandiant report BREEZE COMET, a financially motivated actor active since 2024 that manipulates Brazilian payment systems (Pix, STR) and banking software to conduct fraudulent transfers. The actor combines vishing/RMM social engineering, compromised Brazilian government websites for malware staging, rogue hardware implants and a custom multi-language backdoor suite (COBALTSPIN, REALBREEZE, LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM) plus XWORM, executing fraudulent transactions within 24-48 hours of access.
BREEZE COMET (formerly tracked by Mandiant as UNC5669; GTIG reports overlap with Axur's Plump Spider and Trend Micro's SHADOW-AETHER-064) is a financially motivated intrusion set active since 2024. It targets Brazilian financial institutions, banks, payment processors, retailers, cryptocurrency exchanges, fintechs and banking software providers, aiming to reach systems connected to the National Financial System Network (RSFN) and abuse mTLS credentials to submit authenticated payloads to Pix, STR (Reserves Transfer System) and transactional listeners. GTIG confirmed at least one heist of tens of thousands of USD, with two waves of hundreds of fraudulent transactions executed within 24-48 hours of access being established. The investigation is ongoing.
Initial access in 2024 relied on voice phishing in which operators impersonated IT support to convince users to install commercial RMM tools such as AnyDesk, plus attempted insider recruitment. Axur additionally documented WhatsApp-based vishing, recruitment of managers and IT staff with payment, a share of proceeds and legal support, and use of AnyDesk, TeamViewer, Supremo, HoptoDesk, RustDesk and SyncroRMM. From mid-2025 the actor shifted to staging RMM tools and malware on compromised small Brazilian government websites (bypassing domain-reputation and .gov allowlists), delivering executables disguised as tax/payment receipts (for example ComprovantePDF.exe and ComprovanteBBpix.exe). GTIG also observed rogue hardware devices inserted into retail store networks, and JBoss AS exploitation per Trend Micro reporting (no CVE stated). Compromised government sites in Nigeria, Guinea, Venezuela and Paraguay indicate expansion beyond Brazil.
Post-compromise the actor uses in-memory PowerShell (with Constrained Language Mode bypass), Impacket, ADRecon, ADVipscan, Chisel and GSocket tunnelers, ntdsutil/vssadmin for Active Directory credential theft, and custom scripts searching for terms such as boleto, cnab, remessa, webhook.*pix and instant.*payment as well as mTLS credentials, CI/CD hard-coded secrets and Kubernetes secrets. Kubernetes pods were abused for cloud persistence, and stolen secrets were exfiltrated to the public paste site dontpad.com. Lateral movement abuses RDP, SMB shares and hijacked service accounts. Defender real-time monitoring is disabled with Set-MpPreference -DisableRealtimeMonitoring $true, and Windows event logs (including the Windows Networking VPN Plugin Platform log) are cleared.
The custom malware suite: COBALTSPIN (Rust) is a reverse SOCKS5-over-WebSocket tunneler used to cross internal firewall boundaries to financial API infrastructure; REALBREEZE is an LDAP brute-forcing/credential-validation utility with Portuguese UI strings; LIGHTPAINT (Java) installs SoftEther VPN, adds Windows Defender Firewall allow rules and clears VPN plugin event logs; MILDFROST (Java JAR) is a passive backdoor inside the JVM that uses DnsCommandBeacon.class for slow DNS-tunnel tasking and fetches fresh C++ executables; KICKPLATE (Nim) impersonates Windows Update Health Tools, controls SOCKS5 tunnelers and persists via registry startup keys, services, SYSTEM scheduled tasks via schtasks.exe and .lnk startup shortcuts; BOATBEAM (Go) runs a fake IIS HTTPS server on port 443 that only activates C2 functionality when a specific session cookie is presented. Commodity XWORM is delivered from compromised government sites and persists via startup shortcuts. GTIG notes indicators of LLM-assisted script development (heavily unrolled code, verbose comments, standardized headers) for reconnaissance, credential validation and mass deployment. Related Axur reporting describes the Pix fraud flow: reaching the Pix Gateway, manipulating XML pacs.008 payment orders and forcing the legitimate application to sign them with an HSM-held certificate before submission for instant settlement.
MITRE ATT&CK techniques used in TL-2026-4200
Credential Access
T1003.003 NTDS; T1110.003 Password Spraying; T1552.001 Credentials In Files
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Defense Evasion
Discovery
T1046 Network Service Discovery; T1087.002 Domain Account
Persistence
T1053.005 Scheduled Task; T1078 Valid Accounts; T1543.003 Windows Service; T1547.009 Shortcut Modification
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.004 DNS; T1090 Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application; T1566.004 Spearphishing Voice
Exfiltration
T1567.003 Exfiltration to Text Storage Sites
Impact
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in BREEZE COMET (formerly UNC5669)
- Various — Brazilian financial-sector payment infrastructure (Pix gateways, STR/RSFN-connected systems, banking software)
Vulnerable versions: Environments with RMM-capable endpoints, weak external-portal lockout, hard-coded pipeline credentials or unsegmented payment networks - Red Hat — JBoss AS (exploitation reported by Trend Micro; no CVE stated)
Vulnerable versions: Vulnerable/unpatched JBoss AS servers
Remediation for BREEZE COMET (formerly UNC5669)
Patches
- No CVE is cited in the source; keep internet-facing JBoss AS servers patched and on supported versions
Immediate actions
- Hunt for and block the published SHA-256 hashes and compromised government staging URLs; do not rely on .gov TLD allowlists or domain reputation alone
- Audit endpoints for unapproved RMM tools (AnyDesk, TeamViewer, Supremo, HoptoDesk, RustDesk, SyncroRMM) and SoftEther VPN installations
- Alert on Set-MpPreference -DisableRealtimeMonitoring, clearing of the Windows Networking VPN Plugin Platform log, ntdsutil/vssadmin use and shadow copy creation/deletion
- Alert on DNS or HTTP connections to public paste sites such as dontpad.com from servers, CI/CD and Kubernetes workloads
- Review Pix/STR gateway and HSM signing activity for unexpected pacs.008 order volumes within 24-48 hours of any suspected access
Workarounds
- Deploy the published GTIG YARA rules: M_Utility_REALBREEZE_2, G_Tunneler_COBALTSPIN_1, G_Backdoor_BOATBEAM_1, G_Backdoor_MILDFROST_1
- Enable Google SecOps Mandiant Hunting Rules: Network DNS Connections To Pastebin, Powershell Downloadstring Method With Suspicious Arguments, Powershell Loading Net Assembly
Longer-term hardening
- Enforce application control (WDAC, Gatekeeper/MDM, fapolicyd), block execution from user-writable directories and mount Linux /tmp and /home noexec
- Deploy 802.1X NAC, disable unused switch ports, enforce port security and restrict physical access to network closets to stop rogue hardware
- Enforce PowerShell Constrained Language Mode, Script Block Logging (Event ID 4104) and AMSI
- Mandate phishing-resistant MFA, enforce lockout on all external portals and train users on IT-support vishing and insider-recruitment approaches
- Perform TLS decryption/DPI on egress, block unnecessary outbound ports and tunneling tools (Chisel, GSocket) and segment SMB (445) and RDP (3389)
- Harden Kubernetes with strict RBAC, least-privilege service accounts, admission controllers (OPA Gatekeeper, Kyverno), Pod Security Admission, no privileged containers and egress network policies
- Use a centralized secrets manager, remove hard-coded keys from code and pipelines, apply layer 7 micro-segmentation to financial workloads and PAM with dedicated jump hosts
Timeline of BREEZE COMET (formerly UNC5669)
- BREEZE COMET (then UNC5669) activity begins in 2024 (year-level date only), relying on vishing and commercial RMM tools such as AnyDesk for initial access
- Around mid-2025 (approximate), actor shifts to staging RMM tools and malware on compromised Brazilian government websites and introduces its custom malware suite
- Axur publishes initial Plump Spider research on systemic Pix fraud (vishing, RMM, insider recruitment, pacs.008 manipulation and HSM abuse)
- Axur updates its Plump Spider report with additional reconnaissance and social-engineering techniques
- Trend Micro identifies SHADOW-AETHER-064 (April 2026), an AI-augmented campaign against Brazilian financial organizations using JBoss AS exploitation, Chisel, Neo-reGeorg and SOCKTZ; GTIG reports overlap with BREEZE COMET
- Google Threat Intelligence Group and Mandiant publish the BREEZE COMET report, disclosing the custom backdoor suite, IOCs and four YARA rules
Sources cited for BREEZE COMET (formerly UNC5669)
- Financially Motivated Threat Actor BREEZE COMET Targets Brazil
- Axur reveals Plump Spider modus operandi: systemic Pix fraud
- Axur CTI Bulletin - Plump Spider
- Trend Micro: Vibe Hacking - Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America (SHADOW-AETHER-064)
- VirusTotal GTI Collection - BREEZE COMET IOCs
Detection coverage for TL-2026-4200
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4200 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4200
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.