As reported by The Hacker News, Google Threat Intelligence Group and Mandiant have published detailed findings on Breeze Comet (formerly UNC5669), a financially motivated threat actor orchestrating fraudulent transactions through Brazilian payment infrastructure. The campaign, active since at least 2024 and overlapping with CrowdStrike's Plump Spider and Trend Micro's SHADOW-AETHER-064 tracking, represents a significant evolution in Latin American cybercrime — one that moves beyond credential theft into direct payment rail manipulation.

Threat Alert: As reported by The Hacker News, Google Threat Intelligence Group and Mandiant have published detailed findings on Breeze Comet (formerly UNC5669), a financially motivated threat actor orchestrating fraudulent transactions through Brazilian payment infrastructure.

Why This Campaign Is Structurally Different

Most financially motivated intrusion reporting focuses on ransomware or banking trojan deployment. Breeze Comet is notable because its end goal is neither encryption nor exfiltration — it is transactional fraud executed through legitimate payment APIs. The group specifically targets organizations holding RSFN (National Financial System Network) access and mTLS credentials required to send authenticated transactional payloads to Pix and STR. This is a fundamentally different attack chain than stealing customer account credentials.

What this tells us is that the adversary has developed deep familiarity with Brazil's payment architecture. The four prerequisites GTIG outlines — RSFN access, mTLS credentials, Active Directory and cloud footholds, and knowledge of target transaction workflows — indicate pre-operational reconnaissance that goes well beyond opportunistic intrusion. This is structured financial system abuse, not smash-and-grab fraud.

The operational complexity required to authenticate to Pix or STR via mTLS and submit valid transactional payloads suggests Breeze Comet either includes members with insider knowledge of Brazilian banking software or has acquired that expertise through sustained targeting of fintech and payment processor staff.

Initial Access Patterns Defenders Should Note

The group's initial access combines three vectors that security teams frequently underestimate in isolation but are devastating in combination:
Initial Access Patterns Defenders Should Note
Voice-based social engineering via WhatsApp — impersonating IT support to guide victims through installing RMM tools or executing PowerShell recon scripts. This bypasses traditional email security controls entirely.
Password spraying against financial entity credentials — exploiting weak MFA enforcement or legacy authentication paths.
Exploitation of vulnerable JBoss AS servers — a well-documented attack surface that many organizations still fail to inventory properly, particularly in legacy payment processing environments.

The JBoss attack path is especially concerning. JBoss Application Server has been end-of-life for years, yet it remains embedded in financial infrastructure across Latin America. Web shell deployment on these servers gives attackers a persistent foothold that can survive workstation reimaging and MFA resets.

Geographic Expansion Risk

GTIG's observation that Breeze Comet's infrastructure may extend to other Latin American and African countries is significant. Brazil's Pix system has become a reference architecture for instant payment systems globally. Countries developing similar real-time payment rails — including Nigeria's NIPS, India's UPI ecosystem participants with Brazilian partnerships, and various African mobile money integrations — should treat this campaign as a preview of adversarial tradecraft that will migrate as payment modernization spreads.

Shield53 Recommendations

Organizations operating in or interfacing with Brazilian financial systems should take the following actions:

  • Inventory and segregate RSFN-connected systems. Any server or service with RSFN connectivity should be in a dedicated network segment with strict egress controls and enhanced logging on mTLS-authenticated sessions.
  • Audit JBoss AS deployments immediately. If JBoss cannot be replaced, implement WAF rules blocking known web shell upload patterns, restrict management interface exposure, and deploy file integrity monitoring on deployment directories.
  • Restrict RMM tool execution. Block AnyDesk and similar tools by default via application control. Require an approved break-glass process with ticketing and time-bound access for any legitimate RMM use.
  • Implement transaction anomaly detection on payment APIs. Monitor for unusual transaction volumes, off-hours submissions, new destination accounts, and mTLS sessions originating from unexpected infrastructure or geographies.
  • Harden WhatsApp and voice-based social engineering defenses. Train finance and IT staff specifically on IT support impersonation scenarios. Establish a verified callback protocol using known internal numbers for any support interaction requesting software installation.
  • Review mTLS certificate management. Ensure certificates used for Pix and STR authentication are stored in hardware security modules, not on accessible application servers. Implement certificate rotation and usage alerting.

The Breeze Comet campaign illustrates a broader trend: as payment systems become faster and more API-driven, the attack surface shifts from end-user accounts to the institutional credentials and infrastructure that authorize transactions at scale. Defenders must adapt their monitoring and access controls accordingly.