Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
Summary: CrowdStrike is tracking a previously undocumented Brazil-based threat actor it calls Slim Spider, linked to attacks on Brazilian financial institutions since at least March 2026, including a multi-stage intrusion at one institution in late March 2026 aimed at its cryptocurrency assets and instant payment accounts. The group used custom Bash scripts to pull temporary cloud credentials from instance metadata over socket connections, enumerated secrets in the cloud credential manager, modified secret-extracting scripts with sed, invoked Foundry's cast tool to derive an Ethereum wallet address from a stolen private key, and signed cryptographically via OpenSSL in Bash; it also pivoted to Azure DevOps to run malicious pipelines deploying implants across a managed Kubernetes cluster, including one named "spi" impersonating the Pix payment system's infrastructure.
What you should know: CrowdStrike notes that access to custody credentials controlling cryptocurrency wallets can cause devastating financial loss, and an exposed command-and-control panel it found displayed compromised hosts from several Brazil-based banks and fintechs. Two separate groups now target Pix, and Breeze Comet has taken the same approach to municipal websites in Nigeria, Paraguay, Ghana, and Venezuela.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026