# BREEZE COMET Exploits Brazilian Financial Systems

> BREEZE COMET, a financially motivated threat actor, targets Brazilian financial services for fraudulent transfers, leveraging custom malware and AI for development.

- Published: 2026-09-01T12:57:45.000Z
- Severity: high
- Category: Threat Intel
- Tags: Brazil, Financial Services, Fraud, Malware, BREEZE COMET
- Author: Runtime Rebel Intel
- Primary source: https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/
- Canonical: https://runtimerebel.com/blog/breeze-comet-exploits-brazilian-financial-systems

## Key points

- Immediate impact: BREEZE COMET conducts fraudulent transfers affecting Brazilian financial services, retail, and eCommerce organizations.
- Affected systems: Payment systems like Pix, STR, and Boleto, along with banking software, APIs, and cloud environments.
- Remediation: Prioritize patching JBoss AS servers, enhance multi-factor authentication, and monitor for RMM tools.

## BREEZE COMET Targets Brazilian Financial Sector

Beginning in 2024, the financially motivated [threat actor](/glossary#threat-actor) known as BREEZE COMET (tracked by Google [Threat Intelligence](/glossary#threat-intelligence) Group (GTIG) as formerly UNC5669) has actively compromised Brazilian financial services, retail, and eCommerce organizations. This actor specializes in manipulating payment systems and banking software to execute fraudulent transfers. The activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064. BREEZE COMET's tactics have evolved to include a customized [malware](/glossary#malware) suite and the use of compromised, trusted websites for [initial access](/glossary#initial-access), command and control ([C2](/glossary#c2)), and interaction with financial software and payment APIs. Notably, evidence suggests BREEZE COMET is leveraging generative artificial intelligence ([AI](/glossary#ai)) to support malware development, potentially increasing the scale and sophistication of future operations. Their operational infrastructure also indicates a possible intent to expand targeting to other countries in Latin America and Africa, signaling a broader regional threat.

### BREEZE COMET Targeting and Objectives

BREEZE COMET operations specifically target organizations with permissions to conduct transactions through banking software, APIs, and payment systems such as Pix, STR (Brazilian Reserves Transfer System), and Boleto. This encompasses a range of entities including banks, payment processors, retailers, exchanges, and fintech/banking software providers. To achieve their objective of conducting fraudulent transfers, BREEZE COMET requires persistent access to the National Financial System Network (Rede Nacional do Setor Financeiro, RSFN), mTLS credentials for authenticated transactional orders, and multiple accounts within targeted organizations' Active Directory and/or cloud environments. A deep understanding of an organization’s transfer processing procedures, network controls, fintech integrations, and anti-fraud systems is also crucial for their success. To support these requirements, BREEZE COMET operates in multiple compromised environments concurrently, using custom C2 malware to automate [reconnaissance](/glossary#reconnaissance), [lateral movement](/glossary#lateral-movement), [persistence](/glossary#persistence), and [data exfiltration](/glossary#data-exfiltration), detailing the comprehensive `BREEZE COMET TTPs financial services` organizations must contend with.

### Initial Compromise and Foothold Establishment

BREEZE COMET employs diverse methods for initial access. Early compromises involved [password spraying](/glossary#password-spraying) and voice [phishing](/glossary#phishing), where actors impersonated IT support to convince users to install [Remote Monitoring and Management (RMM)](/glossary#remote-monitoring-and-management-rmm) tools like AnyDesk. In mid-2025 (as reported by GTIG), BREEZE COMET leveraged compromised Brazilian small government websites to stage RMM tools, infostealers disguised as legitimate tax or receipt documents (e.g., `ComprovantePDF.exe`), or backdoors like XWORM. These compromised government domains served as C2 endpoints, allowing the threat actors to bypass domain reputation filters. GTIG observed this behavior replicated with municipal domains in Nigeria, Paraguay, Ghana, and Venezuela, suggesting expanding geographical focus. The threat actor also established footholds by connecting rogue hardware devices directly into retail store networks. From this initial network access, BREEZE COMET moved laterally and deployed Netcat alongside custom scripts to retrieve post-exploitation frameworks from external open directories. Trend Micro reported that the group has also exploited vulnerabilities in JBoss AS servers to gain initial access.

### [Privilege Escalation](/glossary#privilege-escalation), Internal Reconnaissance, and Lateral Movement

For privilege escalation and internal reconnaissance, BREEZE COMET utilizes publicly available utilities such as Impacket, ADRecon, and ADVipscan. These tools are often downloaded from GitHub repositories and executed in memory via PowerShell to evade detection. The group also deploys its custom LDAP brute-forcing utility, REALBREEZE. Beyond traditional Active Directory compromise, BREEZE COMET specifically targets development and cloud environments, mining continuous integration/continuous delivery ([CI/CD](/glossary#ci-cd)) pipelines for hard-coded credentials, [API](/glossary#api) keys, and privileged cloud access tokens. Custom scripts are used to search internal host files and environmental variables for mTLS credentials and administrative certificates required to authenticate against core banking systems, using keywords like `boleto`, `cnab`, `remessa`, `webhook.*pix`, and `instant.*payment`.

For lateral movement, BREEZE COMET abuses standard protocols, initiating unauthorized [Remote Desktop Protocol (RDP)](/glossary#remote-desktop-protocol-rdp) sessions and executing commands via Server Message Block (SMB) network file shares, often leveraging hijacked service accounts.

## Actionable Recommendations to Mitigate BREEZE COMET Fraudulent Transfers

To effectively `mitigate BREEZE COMET fraudulent transfers` and protect financial assets, organizations should prioritize the following defensive measures, drawing from insights provided by [Google Cloud Blog](https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/):

*   **[Vulnerability](/glossary#vulnerability) Management**: Immediately identify and [patch](/glossary#patch) all known vulnerabilities, particularly those affecting JBoss AS servers and other internet-facing applications, as these have been exploited for initial access.
*   **Enhanced Authentication**: Implement and enforce multi-factor authentication ([MFA](/glossary#mfa)) across all accounts, especially for administrative, financial, and cloud environments, to counter password spraying and [credential theft](/glossary#credential-theft).
*   **Monitor for RMM Tools**: Actively monitor network traffic and [endpoint](/glossary#endpoint) logs for the unauthorized installation or use of Remote Monitoring and Management (RMM) software like AnyDesk. These tools are frequently abused post-compromise.
*   **Employee Training**: Conduct regular [security awareness training](/glossary#security-awareness-training), focusing on identifying and reporting voice phishing ([vishing](/glossary#vishing)) and [social engineering](/glossary#social-engineering) attempts that aim to trick users into installing malware or revealing credentials.
*   **[Network Segmentation](/glossary#network-segmentation)**: Implement stringent network segmentation to limit lateral movement within the network, particularly isolating critical financial systems and development environments.
*   **CI/CD Pipeline Security**: Secure CI/CD environments by enforcing [least privilege](/glossary#least-privilege), regularly rotating credentials and API keys, and implementing [secrets management](/glossary#secrets-management) solutions to prevent hard-coding sensitive information.
*   **Threat Detection for Custom Malware**: Deploy advanced endpoint detection and response ([EDR](/glossary#edr)) solutions capable of detecting and blocking custom malware, including infostealers like `ComprovantePDF.exe` and backdoors such as `XWORM`. Focus on behavioral anomalies indicative of tools like REALBREEZE or Netcat. Security teams need strategies to `detect XWORM malware Brazilian organizations` might encounter.
*   **Log and Audit**: Maintain comprehensive logging for all systems, especially Active Directory, cloud environments, and financial transaction logs. Regularly review these logs for unusual activity, unauthorized access, or suspicious API calls.

**Related:** [DOUBLECUP Malware: Appended PowerShell Payloads in PNG Files](/blog/doublecup-malware-appended-powershell-payloads-in-png-files), [Global Cybercrime Crackdown: Operation HAECHI IV Disrupts Fraud](/blog/global-cybercrime-crackdown-operation-haechi-iv-disrupts-fraud)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/breeze-comet-exploits-brazilian-financial-systems