Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Breeze Comet Brazil-based e-crime cluster with alias overlap and payment-fraud monetization

Threat Actor Meta
First reported
Last updated
Happening score
H score 30
1 unique sources, 2 articles

Summary

Hide ▲

Breeze Comet is now linked to a separate Brazil-focused payment-fraud track, while Slim Spider is a Brazil-based financially motivated cluster active since at least March 2026. CrowdStrike says Slim Spider targeted a Brazil-based financial institution in late March 2026, using custom Bash scripts to steal temporary cloud credentials, enumerate secrets in a cloud credential manager, and reach cryptocurrency assets and Pix accounts. The same report says the actor used OpenSSL signing, backdoors masquerading as infrastructure binaries, Azure DevOps pipelines, and a managed Kubernetes implant named "spi" tied to SPI. CrowdStrike also found an exposed C2 panel with compromised hosts from Brazil-based banks and fintech firms and identified MikeDor as another tool, while the article separately says Breeze Comet has targeted Brazilian payment systems since 2024 and used compromised municipal websites in Nigeria, Paraguay, Ghana, and Venezuela to stage fraudulent activity.

Related Happenings

Breeze Comet-CL-CRI-1163-Plump Spider alliance reshapes ransomware ecosystem operations

Threat Actor Meta
H score35 First: 08.09.2026 19:20 Last: 08.09.2026 19:20 Sources 1

How related: While the Latin American cybercrime ecosystem has historically been defined by client-side, high-volume retail fraud, Breeze Comet's campaigns represent a notable shift that may serve as a model for future financially motivated threats against organizations in this region.

About this happening: Breeze Comet is pushing Latin American cybercrime away from client-side retail fraud and toward direct intrusions into payment infrastructure, increasing risk to Bra...

Open Happening

Slim Spider campaign targeting Brazilian financial institutions and Pix infrastructure

Campaign
H score34 First: 08.09.2026 19:20 Last: 08.09.2026 19:20 Sources 1

How related: A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026.

About this happening: The Slim Spider campaign is tied to multi-stage intrusions against Brazilian financial institutions, putting Pix transfers and cryptocurrency custody secrets a...

Open Happening

Cinder likely continues Pink operations amid data-extortion label overlap

Threat Actor Meta
H score20 First: 07.09.2026 18:51 Last: 07.09.2026 18:51 Sources 1

About this happening: Cinder was assessed as a likely rebrand or continuation of Pink, signaling ongoing identity shifts in the data-extortion ecosystem and complicating attribution across rela...

Open Happening

Breeze Comet Brazilian payment-system fraud campaign

Campaign
H score32 First: 01.09.2026 20:19 Last: 01.09.2026 20:19 Sources 1

How related: Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.

About this happening: Breeze Comet has been conducting a financial intrusion campaign against Brazilian financial services, retail, and e-commerce organizations since 2024, putting paym...

Open Happening

Pink new extortion brand within The Com

Threat Actor Meta
H score31 First: 08.07.2026 19:47 Last: 08.07.2026 19:47 Sources 1

About this happening: Pink is an extortion brand linked to UNC6671 and tied in reporting to Cinder as a likely rebrand or continuation of Pink operations. The activity combines IT hel...

Open Happening

Timeline

  1. 01.09.2026 20:19 3 articles · 13d ago

    Breeze Comet Brazil-based e-crime cluster with alias overlap and payment-fraud monetization

    Initial Disclosure

    The cluster was identified as a Brazil-based e-crime group with activity dating back to September 2023 and a fraud-first monetization model. Alias overlap across vendor tracking tied the actor to a broader financial-crime ecosystem.

    Show sources
    Open in new tab