BREEZE COMET Targets Brazil’s Financial Systems With Custom Malware and AI-Assisted Attacks

BREEZE COMET Is Targeting the Infrastructure Behind Financial Transactions

A financially motivated threat actor known as BREEZE COMET, formerly tracked as UNC5669, is targeting Brazilian financial services, retail, eCommerce and fintech organizations in campaigns designed to manipulate banking software and payment systems.

According to the Google Threat Intelligence Group (GTIG) and Mandiant, the activity has been under investigation since 2024. The group has evolved from using relatively conventional access techniques into a more complex operation involving custom malware, compromised government websites, cloud environments, financial APIs and generative AI-assisted tooling.

The activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064. GTIG says BREEZE COMET is particularly focused on organizations that can conduct transactions through systems including Pix, STR and Boleto.

The campaign is significant because the attackers are not simply attempting to steal individual banking credentials. They are seeking access to the infrastructure and credentials that can authorize transactions within financial environments.

How BREEZE COMET Gains Access

BREEZE COMET has used several initial-access techniques.

Earlier campaigns included password spraying and voice calls in which attackers impersonated IT support personnel. Victims were persuaded to install legitimate Remote Monitoring and Management tools such as AnyDesk, providing attackers with an entry point into the environment.

By mid-2025, GTIG observed another approach: compromising small Brazilian government websites and using them to host malicious files and RMM tools.

The attackers used files disguised as legitimate tax or receipt documents, including ComprovantePDF.exe, alongside malware such as XWORM.

Using trusted government domains gave the attackers an additional advantage. Instead of relying entirely on newly registered malicious domains, they could use compromised websites that already appeared trustworthy to some security controls and users.

GTIG also observed similar activity involving municipal domains in Nigeria, Paraguay, Ghana and Venezuela. The researchers say this could indicate a potentially broader targeting focus.

In 2025, investigators also observed rogue hardware being connected directly to retail store networks. From there, BREEZE COMET moved toward internal systems and used tools such as Netcat and custom scripts.

Trend Micro separately reported exploitation of vulnerabilities in JBoss AS servers as an initial-access method.

The Group Looks Beyond Active Directory

Once inside an environment, BREEZE COMET performs reconnaissance to understand the victim's infrastructure.

GTIG observed the use of publicly available tools including Impacket, ADRecon and ADVipscan, alongside custom malware. Some tools were downloaded from GitHub and executed in memory through PowerShell.

The group also developed REALBREEZE, a custom LDAP brute-forcing utility.

A particularly important part of the campaign is the focus on development and cloud environments. According to Mandiant, BREEZE COMET searches CI/CD environments for hard-coded pipeline credentials, API keys and highly privileged cloud access tokens.

Attackers also searched host files and environmental variables for credentials and certificates that could authenticate against core banking systems.

Observed search terms included references to:

• boleto

• cnab

• remessa

• webhook.*pix

• instant.*payment

This demonstrates why financial organizations need to treat development environments and cloud credentials as part of the financial attack surface, rather than isolating security efforts around traditional banking infrastructure.

COBALTSPIN Helps Attackers Move Through Segmented Networks

BREEZE COMET uses standard network protocols such as RDP and SMB for lateral movement.

The group has also deployed a custom tunneling tool called COBALTSPIN.

Written in Rust, COBALTSPIN creates a reverse SOCKS5 proxy over WebSocket connections. According to GTIG, this allows attackers to route traffic between their command-and-control infrastructure and internal targets through network boundaries.

This is particularly relevant in financial environments where internal networks may be segmented and heavily restricted.

Instead of relying solely on traditional persistence techniques, a tunneling capability can help attackers maintain communication with systems deeper inside the environment.

A Multi-Layered Malware Architecture

BREEZE COMET has developed several custom backdoors to maintain redundant access.

The malware observed by Mandiant includes:

LIGHTPAINT

A Java-based backdoor designed to install and configure a VPN such as SoftEther for persistence. GTIG also observed the attackers modifying Windows Defender Firewall rules and clearing relevant VPN-related event logs.

MILDFROST

A Java JAR backdoor that can establish covert DNS tunnels and act as a fallback command-and-control mechanism.

KICKPLATE

A Nim-based backdoor that impersonates Windows Update Health Tools. It can control SOCKS5 tunnelers, modify registry startup keys and alter Windows services. The attackers also used scheduled tasks and malicious shortcuts as additional persistence mechanisms.

BOATBEAM

A Go-based backdoor that creates a fake IIS HTTPS server on port 443. Its C2 functionality activates after receiving a specific session cookie.

The group also used XWORM during earlier stages of its operations.

Together, these tools demonstrate a layered approach in which multiple access and persistence mechanisms can coexist inside a compromised organization.

Defenses Were Also Targeted

Maintaining access was not the only objective.

GTIG observed BREEZE COMET executing PowerShell commands to disable Windows Defender real-time monitoring on compromised systems.

The attackers also cleared event logs and removed directories created during their operations.

This combination of persistence and defense evasion makes post-compromise investigation more difficult and highlights the importance of centralized telemetry that attackers cannot easily modify from compromised hosts.

Generative AI Is Becoming Part of the Attack Workflow

One of the most notable findings in the investigation is BREEZE COMET's use of large language models.

Mandiant identified evidence that the group used LLMs to accelerate the creation of scripts for activities including:

• Network reconnaissance

• Credential validation

• Mass deployment

• Victim-specific pivoting

• Data extraction

The recovered scripts were described as highly customized and functional. Investigators also observed characteristics such as verbose explanatory comments, standardized execution headers and less manually optimized code structures.

The significance is not that AI independently conducted the campaign. Rather, the investigation indicates that attackers incorporated generative AI into parts of their existing operational workflow.

That distinction matters.

AI can reduce the time required to produce routine scripts and adapt tooling to different environments. In a coordinated intrusion involving several compromised environments, this could help an operator move from reconnaissance to deployment more quickly.

The announcement highlights a broader industry shift toward adversaries using AI to accelerate established cybercrime techniques.

For defenders, the challenge is therefore not only detecting AI-generated code. Security teams must continue identifying the behaviors that the code enables, including unauthorized credential discovery, suspicious PowerShell execution, unusual cloud access and unexpected communication with internal financial systems.

A Look Inside the Attackers' Scripts

Mandiant recovered scripts used by BREEZE COMET for network reconnaissance and other operational tasks. Investigators noted that some of the scripts contained verbose comments and standardized execution structures.

#!/bin/bash
# RODA DENTRO DO 10.0.9.9 - DIRETO NA REDE INTERNA

echo "###############################################"
echo "### STEP 1: ENUM ALL LINUX (SSH PORT 22) ###"
echo "###############################################"

# Scan SSH em todos os ranges conhecidos
echo "=== SCANNING SSH PORTS ==="
> /tmp/ssh_open.txt

Defenses Were Also Targeted

Maintaining access was not the only objective.

GTIG observed BREEZE COMET executing PowerShell commands to disable Windows Defender real-time monitoring on compromised systems.

Set-MpPreference -DisableRealtimeMonitoring $true

The Final Objective: Fraudulent Financial Transactions

The campaign ultimately demonstrates why access to financial infrastructure is valuable to financially motivated attackers.

Mandiant's forensic analysis found that BREEZE COMET used COBALTSPIN and compromised privileged accounts to access core financial applications.

Within 24 to 48 hours of establishing that access, the attackers conducted two waves involving hundreds of fraudulent transactions, based on client reporting and third-party forensic analysis.

Afterward, the attackers cleared event logs and deleted directories created during the intrusion.

Mandiant says BREEZE COMET has successfully carried out at least one heist involving tens of thousands of U.S. dollars in assets.

The announcement does not provide additional details about the specific financial institution or the complete financial impact of that incident.

Why the Campaign Matters

BREEZE COMET represents a shift from conventional client-side banking fraud toward direct intrusion into the infrastructure supporting financial transactions.

The campaign combines:

• Social engineering

• Stolen or compromised credentials

• Trusted infrastructure abuse

• Cloud and CI/CD compromise

• Custom malware

• Network tunneling

• Multiple persistence mechanisms

• Defense evasion

• AI-assisted scripting

• Direct interaction with financial applications and APIs

For financial institutions and fintech providers, the lesson is broader than defending against a particular malware family.

The organization must protect the complete transaction chain, from employee endpoints and branch networks to Active Directory, cloud environments, CI/CD systems, credentials, APIs and financial applications.

The development also reflects growing demand for security controls that can detect behavior rather than relying solely on reputation-based blocking.

Recommended Defensive Measures

Mandiant and GTIG provide several hardening recommendations.

1. Control RMM and User-Writable Execution

Organizations should use application controls to restrict execution from user-writable directories.

Security teams should also audit software inventories for portable RMM tools and unauthorized services or daemons.

Employee training remains important because impersonation of IT support was part of the observed access techniques.

2. Secure Branch and Retail Networks

The researchers recommend deploying 802.1X Network Access Control across physical Ethernet ports.

Unused switch ports should be disabled, port security should be enforced on important network connections, and physical access to networking infrastructure should be restricted.

This is particularly relevant given the observed use of rogue hardware connected directly to retail networks.

3. Strengthen Identity and PowerShell Controls

Recommended controls include:

• PowerShell Constrained Language Mode

• Script Block Logging

• AMSI

• Phishing-resistant MFA

• Lockout controls

• Monitoring of administrative utilities

These controls can increase visibility into suspicious credential and reconnaissance activity.

4. Restrict Lateral Movement

Network segmentation should limit unnecessary SMB and RDP communication between workstations and servers.

Organizations should also restrict unnecessary outbound protocols and monitor tunneling utilities.

GTIG recommends deep packet inspection rather than relying only on domain reputation or allowlists for trusted top-level domains.

5. Protect Kubernetes and Cloud Workloads

Organizations should apply least-privilege Kubernetes RBAC, use admission controls to prevent privileged containers and apply egress network policies.

Cloud secrets should not be embedded directly in application code or CI/CD pipelines.

6. Protect Financial Credentials and Applications

Mandiant recommends centralized secrets management with access logging, identity-based or Layer 7 micro-segmentation for financial workloads and privileged access through dedicated jump hosts.

These measures can help reduce the opportunity for compromised credentials to become direct access to sensitive financial systems.

What Security Teams Should Take Away

BREEZE COMET shows how financially motivated cybercrime can combine traditional intrusion techniques with increasingly specialized infrastructure.

The threat actor did not depend on a single malware family or one access method. Instead, the operation used multiple paths into an organization, custom tools for reconnaissance and lateral movement, redundant persistence mechanisms and access to credentials capable of interacting with financial systems.

The use of generative AI adds another layer to this development. The investigation indicates that LLMs were being used to accelerate parts of the operational workflow rather than replacing the broader attack infrastructure.

For enterprises, this could mean defenders need to prepare for shorter adversary development cycles while maintaining strong controls around identity, cloud environments, network segmentation, secrets and financial APIs.

The most important defensive principle is to protect the entire environment as an interconnected system. A compromised endpoint, CI/CD credential or cloud token can become relevant to financial security when attackers can move from that foothold toward systems capable of authorizing transactions.