Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Summary: Breeze Comet, a Brazil-based financially motivated threat actor tracked by Google Threat Intelligence Group and Mandiant, has targeted Brazilian financial services, retail, and e-commerce organizations since 2024 and carried out at least one heist worth tens of thousands of U.S. dollars. The group gains initial access through password spraying and voice calls impersonating IT support to install RMM tools such as AnyDesk, or by exploiting vulnerable JBoss AS servers to deploy web shells, then uses custom backdoors and a reverse SOCKS5 proxy called COBALTSPIN to execute hundreds of fraudulent transactions through payment systems including Pix, STR, and Boleto before clearing event logs.
Bottom line: This group does not skim retail payments; it needs RSFN access, mTLS credentials for authenticated Pix and STR orders, and knowledge of your transfer procedures and anti-fraud systems, meaning a single compromised entity with those permissions can move money at scale. Google notes the infrastructure may extend into Latin America and Africa, and that LLM-assisted malware development points to shorter adversary turnaround times.
Read the original at The Hacker News ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026