# Slim Spider Targets Brazilian Financial Systems and Crypto Assets

> Discover how the newly documented threat actor Slim Spider targets Brazilian financial infrastructure and cryptocurrency assets.

- Published: 2026-09-08T19:09:24.000Z
- Severity: medium
- Category: Threat Intel
- Tags: Slim Spider, Breeze Comet, Credential Theft, Cloud Security, Ransomware
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html
- Canonical: https://runtimerebel.com/blog/slim-spider-targets-brazilian-financial-systems-and-crypto-assets

## Key points

- Immediate impact: Financial institutions in Brazil face targeted attacks against cryptocurrency custody secrets and instant payment infrastructure.
- Affected systems: Cloud environments, Azure DevOps pipelines, Kubernetes clusters, and digital asset custody platforms.
- Remediation: Audit cloud credential manager access, monitor for anomalous Bash script execution, and secure CI/CD pipelines.

## Overview of Slim Spider Activity

A previously undocumented, financially motivated [threat actor](/glossary#threat-actor) tracked as Slim Spider has targeted Brazilian financial institutions since at least March 2026, according to [CrowdStrike](https://www.crowdstrike.com/). The campaign demonstrates deep operational knowledge of regional financial infrastructure, including the instant payment service Pix, digital asset platforms, and corporate cloud environments. 

Security teams researching this campaign need actionable guidance on how to detect Slim Spider cloud intrusions before digital asset wallets are compromised. The threat actor specifically focuses on extracting credentials tied to cryptocurrency assets and instant payment accounts.

## Technical Analysis and TTPs

During a multi-stage intrusion observed in late March 2026, Slim Spider deployed custom Bash scripts to query cloud instance metadata and steal temporary cloud credentials over socket connections. After gaining access to the cloud environment, the group enumerated stored secrets within credential managers and used the `sed` utility to modify secret-extracting scripts.

Rather than relying on third-party libraries that introduce detection risks, the actors implemented cloud-native cryptographic signing directly via OpenSSL. They invoked `cast`, a component of the Foundry Ethereum developer toolkit, to derive Ethereum wallet addresses from stolen private keys.

### [Lateral Movement](/glossary#lateral-movement) and [C2](/glossary#c2) Infrastructure

Key technical behaviors identified in the campaign include:

* **Container Cluster Pivoting:** Moving to establish access to nodes running in cloud container service clusters.
* **[Defense Evasion](/glossary#defense-evasion):** Deploying backdoors that mimic infrastructure-related binaries to blend with legitimate administrative tooling.
* **Azure [DevOps](/glossary#devops) Abuse:** Leveraging compromised credentials to run malicious pipelines that deploy implants across managed Kubernetes clusters.
* **Impersonation Implants:** Utilizing an implant named "spi" to masquerade as Sistema de Pagamentos Instantâneos (SPI), the central digital infrastructure processing Pix payments.
* **Go-Based Tooling:** Utilizing MikeDor, a Go-based [backdoor](/glossary#backdoor) capable of harvesting sensitive information and monitoring user activity.

## Broader Regional Impact

This activity coincides with operations from another group dubbed Breeze Comet (also tracked as Plump Spider), which has targeted Brazilian financial systems since 2024 to execute fraudulent transactions. The simultaneous emergence of campaigns targeting core instant payment infrastructure highlights a shift from opportunistic retail banking fraud to direct intrusions into regional financial switches.

## Mitigations and Recommendations

Defenders operating cloud environments and financial infrastructure should prioritize the following defensive controls:

* **Cloud Metadata Protection:** Restrict access to instance metadata services and monitor for unauthorized queries originating from internal workloads.
* **Credential Guardrails:** Audit permissions assigned to cloud credential managers and enforce strict least-privilege access for automated pipelines.
* **[CI/CD](/glossary#ci-cd) Security:** Harden Azure DevOps and Kubernetes clusters against pipeline manipulation by implementing rigorous code review and approval gates for deployment changes.

**Related:** [UNC6671 Rebrands: Multi-Brand Vishing and Cloud Extortion](/blog/unc6671-rebrands-multi-brand-vishing-and-cloud-extortion), [AI-Assisted Cyber Attacks Accelerate Enterprise Breaches](/blog/ai-assisted-cyber-attacks-accelerate-enterprise-breaches)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/slim-spider-targets-brazilian-financial-systems-and-crypto-assets