Breeze Comet Brazilian payment-system fraud campaign
Campaign
Summary
Hide ▲
Show ▼
Breeze Comet has been conducting a financial intrusion campaign against Brazilian financial services, retail, and e-commerce organizations since 2024, putting payment systems and banking software at risk. The operation uses password spraying, IT-support impersonation, AnyDesk and other RMM tools, and JBoss AS web shells to reach internal environments and manipulate transactions. It has already enabled fraudulent transfers and hundreds of fraudulent transactions, making the campaign a direct threat to banks, payment processors, retailers, exchanges, and fintech providers.
Related Happenings
Breeze Comet-CL-CRI-1163-Plump Spider alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score35
First: 08.09.2026 19:20
Last: 08.09.2026 19:20
Sources 1
About this happening:
Breeze Comet is pushing Latin American cybercrime away from client-side retail fraud and toward direct intrusions into payment infrastructure, increasing risk to Bra...
Breeze Comet-CL-CRI-1163-Plump Spider alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: Breeze Comet is pushing Latin American cybercrime away from client-side retail fraud and toward direct intrusions into payment infrastructure, increasing risk to Bra...
Slim Spider campaign targeting Brazilian financial institutions and Pix infrastructure
Campaign
H score34
First: 08.09.2026 19:20
Last: 08.09.2026 19:20
Sources 1
About this happening:
The Slim Spider campaign is tied to multi-stage intrusions against Brazilian financial institutions, putting Pix transfers and cryptocurrency custody secrets a...
Slim Spider campaign targeting Brazilian financial institutions and Pix infrastructure
CampaignAbout this happening: The Slim Spider campaign is tied to multi-stage intrusions against Brazilian financial institutions, putting Pix transfers and cryptocurrency custody secrets a...
Breeze Comet Brazil-based e-crime cluster with alias overlap and payment-fraud monetization
Threat Actor Meta
H score30
First: 01.09.2026 20:19
Last: 01.09.2026 20:19
Sources 1
How related:
According to CrowdStrike, the e-crime group is operating out of Brazil and has been active since September 2023, monetizing their intrusions by gaining unauthorized access to internal payment systems and carrying out fraudulent transactions.
About this happening:
Breeze Comet is now linked to a separate Brazil-focused payment-fraud track, while Slim Spider is a Brazil-based financially motivated cluster active since at least ...
Breeze Comet Brazil-based e-crime cluster with alias overlap and payment-fraud monetization
Threat Actor MetaHow related: According to CrowdStrike, the e-crime group is operating out of Brazil and has been active since September 2023, monetizing their intrusions by gaining unauthorized access to internal payment systems and carrying out fraudulent transactions.
About this happening: Breeze Comet is now linked to a separate Brazil-focused payment-fraud track, while Slim Spider is a Brazil-based financially motivated cluster active since at least ...
BlackFile vishing extortion campaign targeting retail and hospitality organizations
Campaign
H score37
First: 24.04.2026 21:26
Last: 24.04.2026 21:26
Sources 1
About this happening:
BlackFile (UNC6671) is a vishing-driven extortion campaign that began in February 2026 and later rebranded to Redact. The operators impersonate IT helpdesk staff...
BlackFile vishing extortion campaign targeting retail and hospitality organizations
CampaignAbout this happening: BlackFile (UNC6671) is a vishing-driven extortion campaign that began in February 2026 and later rebranded to Redact. The operators impersonate IT helpdesk staff...
Latest development: 11.09.2026 20:26
Microsoft detailed passkey- and SSO-themed social engineering used by threat actors tied to ShinyHunters, Helix, Storm-3121, and Storm-3032 to compromise corporate Microsoft accounts and steal Microsoft 365 data. The activity, observed since May 2026, uses help-desk impersonation, SMS-delivered phishing links, fake Microsoft login pages, AiTM portals, and device-code phishing, and Microsoft also observed suspicious OfficeHome sign-ins, post-compromise reconnaissance, and data collection from SharePoint Online, OneDrive for Business, Outlook Web, and Exchange Online.
Timeline
-
01.09.2026 20:19 2 articles · 13d ago
Breeze Comet targets Brazilian payment systems for fraudulent transfers
Initial DisclosureBreeze Comet, formerly UNC5669, is described as a financially motivated threat actor targeting Brazilian financial services, retail, and e-commerce organizations since 2024, with Google Threat Intelligence Group and Mandiant saying it specializes in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. The campaign is associated with unauthorized access to internal payment systems, use of password spraying and IT-support impersonation, installation of RMM tools such as AnyDesk, exploitation of vulnerable JBoss AS servers with web shells, and follow-on tooling including Chisel, COBALTSPIN, and custom backdoors used to maintain access to financial API infrastructure.
Show sources
- Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems — thehackernews.com — 01.09.2026 20:19
- Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems — thehackernews.com — 01.09.2026 20:19