# BREEZE COMET (formerly UNC5669) - Financially Motivated Actor Targeting Brazilian Payment Systems and Banking Software

> Google Threat Intelligence Group and Mandiant report BREEZE COMET, a financially motivated actor active since 2024 that manipulates Brazilian payment systems (Pix, STR) and banking software to conduct fraudulent transfers. The actor combines vishing/RMM social engineering, compromised Brazilian government websites for malware staging, rogue hardware implants and a custom multi-language backdoor suite (COBALTSPIN, REALBREEZE, LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM) plus XWORM, executing fraudulent transactions within 24-48 hours of access.

- **Published:** 2026-10-23T00:40:14Z
- **Last reviewed:** 2026-10-23T00:40:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4200
- **ID:** TL-2026-4200
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** BREEZE COMET
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BREEZE COMET (formerly tracked by Mandiant as UNC5669; GTIG reports overlap with Axur's Plump Spider and Trend Micro's SHADOW-AETHER-064) is a financially motivated intrusion set active since 2024. It targets Brazilian financial institutions, banks, payment processors, retailers, cryptocurrency exchanges, fintechs and banking software providers, aiming to reach systems connected to the National Financial System Network (RSFN) and abuse mTLS credentials to submit authenticated payloads to Pix, STR (Reserves Transfer System) and transactional listeners. GTIG confirmed at least one heist of tens of thousands of USD, with two waves of hundreds of fraudulent transactions executed within 24-48 hours of access being established. The investigation is ongoing.

Initial access in 2024 relied on voice phishing in which operators impersonated IT support to convince users to install commercial RMM tools such as AnyDesk, plus attempted insider recruitment. Axur additionally documented WhatsApp-based vishing, recruitment of managers and IT staff with payment, a share of proceeds and legal support, and use of AnyDesk, TeamViewer, Supremo, HoptoDesk, RustDesk and SyncroRMM. From mid-2025 the actor shifted to staging RMM tools and malware on compromised small Brazilian government websites (bypassing domain-reputation and .gov allowlists), delivering executables disguised as tax/payment receipts (for example ComprovantePDF.exe and ComprovanteBBpix.exe). GTIG also observed rogue hardware devices inserted into retail store networks, and JBoss AS exploitation per Trend Micro reporting (no CVE stated). Compromised government sites in Nigeria, Guinea, Venezuela and Paraguay indicate expansion beyond Brazil.

Post-compromise the actor uses in-memory PowerShell (with Constrained Language Mode bypass), Impacket, ADRecon, ADVipscan, Chisel and GSocket tunnelers, ntdsutil/vssadmin for Active Directory credential theft, and custom scripts searching for terms such as boleto, cnab, remessa, webhook.*pix and instant.*payment as well as mTLS credentials, CI/CD hard-coded secrets and Kubernetes secrets. Kubernetes pods were abused for cloud persistence, and stolen secrets were exfiltrated to the public paste site dontpad.com. Lateral movement abuses RDP, SMB shares and hijacked service accounts. Defender real-time monitoring is disabled with Set-MpPreference -DisableRealtimeMonitoring $true, and Windows event logs (including the Windows Networking VPN Plugin Platform log) are cleared.

The custom malware suite: COBALTSPIN (Rust) is a reverse SOCKS5-over-WebSocket tunneler used to cross internal firewall boundaries to financial API infrastructure; REALBREEZE is an LDAP brute-forcing/credential-validation utility with Portuguese UI strings; LIGHTPAINT (Java) installs SoftEther VPN, adds Windows Defender Firewall allow rules and clears VPN plugin event logs; MILDFROST (Java JAR) is a passive backdoor inside the JVM that uses DnsCommandBeacon.class for slow DNS-tunnel tasking and fetches fresh C++ executables; KICKPLATE (Nim) impersonates Windows Update Health Tools, controls SOCKS5 tunnelers and persists via registry startup keys, services, SYSTEM scheduled tasks via schtasks.exe and .lnk startup shortcuts; BOATBEAM (Go) runs a fake IIS HTTPS server on port 443 that only activates C2 functionality when a specific session cookie is presented. Commodity XWORM is delivered from compromised government sites and persists via startup shortcuts. GTIG notes indicators of LLM-assisted script development (heavily unrolled code, verbose comments, standardized headers) for reconnaissance, credential validation and mass deployment. Related Axur reporting describes the Pix fraud flow: reaching the Pix Gateway, manipulating XML pacs.008 payment orders and forcing the legitimate application to sign them with an HSM-held certificate before submission for instant settlement.

## MITRE ATT&CK

- T1566.004 Spearphishing Voice
- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1547.009 Shortcut Modification
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1036 Masquerading
- T1110.003 Password Spraying
- T1003.003 NTDS
- T1552.001 Credentials In Files
- T1087.002 Domain Account
- T1046 Network Service Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1090 Proxy
- T1071.004 DNS
- T1567.003 Exfiltration to Text Storage Sites
- T1657 Financial Theft

## Sources

- [Financially Motivated Threat Actor BREEZE COMET Targets Brazil](https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/)
- [Axur reveals Plump Spider modus operandi: systemic Pix fraud](https://blog.axur.com/en-us/axur-reveals-plump-spider-modus-operandi-systemic-pix-fraud)
- [Axur CTI Bulletin - Plump Spider](https://cti.axur.com/bulletins/eeda3f5c-def6-4a7f-ad0c-754d5823de57)
- [Trend Micro: Vibe Hacking - Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America (SHADOW-AETHER-064)](https://www.trendmicro.com/en_us/research/26/e/vibe-hacking-two-ai-augmented-campaigns-target-government-and-financial-sectors-in-latin-america.html)
- [VirusTotal GTI Collection - BREEZE COMET IOCs](https://www.virustotal.com/gui/collection/de4e533c9062c62b3ba3a5d88eff111156075f2c92d243737edeead6481a9fd5)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4200