GOOGLE Threat Intelligence Group (GTIG) says the financially motivated actor BREEZE COMET, formerly tracked as UNC5669, has targeted Brazilian banks, payment processors, retailers, exchanges and fintech providers since 2024. The group seeks access to organisations authorised to use Brazil’s Pix and STR payment systems, Boleto processing and related APIs, along with mTLS credentials and privileged accounts.
Mandiant investigated compromises involving password spraying, voice phishing that persuaded users to install AnyDesk, malware staged on compromised Brazilian municipal websites and, in 2025, rogue hardware connected directly to retail networks. GTIG also observed the actor targeting municipal domains in Nigeria, Paraguay, Ghana and Venezuela, while Trend Micro reported exploitation of JBoss AS vulnerabilities.
Once inside, BREEZE COMET uses tools including REALBREEZE for LDAP brute forcing and COBALTSPIN, a Rust-based reverse SOCKS5 tunneller, to move through segmented networks and reach financial infrastructure. Its bespoke backdoors include LIGHTPAINT, MILDFROST, KICKPLATE and BOATBEAM, supported by compromised Kubernetes workloads, stolen CI/CD and cloud credentials, and disabled Windows Defender monitoring.
Mandiant says recovered scripts showed evidence of large language model use for reconnaissance, credential validation, deployment and data extraction. In one client-related case, the actor reached core financial applications and conducted two waves of hundreds of fraudulent transactions within 24–48 hours; the report says at least one theft involved tens of thousands of US dollars.
Organisations are advised to block unauthorised RMM tools and rogue hardware, enforce phishing-resistant MFA and application controls, segment SMB/RDP access, protect cloud and Kubernetes secrets, and hunt using GTIG’s published indicators and YARA rules.