Security · 1 Sep 2026 · Rob Nidschelm

They Stole the Keys to Brazil’s Payment Rails, Then Sent Hundreds of Transfers

A financially motivated group stole the credentials and certificates that let trusted organisations send instructions into Brazil’s payment systems. Within 24 to 48 hours of reaching core financial applications, the attackers executed two waves containing hundreds of fraudulent transactions.

Google Threat Intelligence Group and Mandiant track the actor as BREEZE COMET, previously UNC5669. The operation is not ordinary banking malware aimed at individual customers. It targets banks, payment processors, retailers, exchanges, fintech companies and banking-software providers that already possess legitimate access to Pix, the Brazilian Reserves Transfer System and boleto-processing workflows.

The distinction matters. Instead of persuading a victim to approve one fraudulent payment, the group tries to inherit the authority of an organisation that can submit transactions at scale.

The real target was transactional authority

BREEZE COMET’s objective requires more than access to an employee workstation. Mandiant says the actor seeks access to Brazil’s National Financial System Network, privileged accounts inside Active Directory or cloud environments, and mutual TLS credentials that authenticate transactional orders.

Those certificates are not merely secrets stored on a server. They are proof that a payment instruction came from an authorised participant. Once attackers possess the certificate, the account and enough knowledge of the victim’s processing rules, a malicious order can arrive through the same trusted channel as legitimate business.

Mandiant observed the group searching files and environment variables for terms associated with Pix webhooks, boleto files, remittance processing and instant payments. It also mined CI/CD environments for pipeline credentials, API keys and highly privileged cloud tokens. The development environment became a route to the financial environment because both held pieces of the same trust chain.

Voice calls, government websites and rogue hardware opened the door

The group has used several initial-access methods. Mandiant observed password spraying and callers impersonating IT support to persuade users to install remote-management tools such as AnyDesk. Axur separately reported voice-phishing activity and possible attempts to recruit insiders.

Other campaigns used compromised Brazilian government and municipal websites to host remote-management tools, information stealers and XWORM backdoors disguised as tax or receipt documents. Trusted public-sector domains also served as command-and-control infrastructure, helping the traffic pass reputation-based controls that treated a government domain as inherently safe.

The same staging pattern appeared on municipal domains in Nigeria, Paraguay, Ghana and Venezuela. Google says this may indicate that the group’s infrastructure and targeting ambitions extend beyond Brazil.

In at least one retail intrusion, BREEZE COMET connected rogue hardware directly to a store network. That is an uncomfortable reminder that a payment-system attack can begin at a branch Ethernet port, not only at an internet-facing application.

The group built several ways back in

Once inside, BREEZE COMET used familiar tools including Impacket, ADRecon, PowerShell, RDP and SMB. It paired them with custom malware designed for the victim’s environment:

• COBALTSPIN creates a reverse SOCKS5 proxy over WebSockets so the attacker can route traffic through segmented networks towards financial APIs.
• LIGHTPAINT installs and preserves a legitimate VPN, changes firewall rules and clears relevant event logs.
• MILDFROST hides inside a Java process and uses DNS for a slow fallback command channel.
• KICKPLATE impersonates Windows Update Health Tools and manages persistence, services and tunnelling utilities.
• BOATBEAM presents a fake IIS HTTPS service and activates its backdoor functions only when it receives a specific session cookie.

Mandiant also found malicious Kubernetes pods used for persistence and cloud-secret theft. Some stolen data was sent to public notepad services. The operation therefore crosses endpoints, identity systems, developer tooling, cloud workloads and payment applications rather than remaining inside one neatly defined incident boundary.

AI shortened the attackers’ development cycle

Recovered scripts showed signs that large language models had helped generate tooling for reconnaissance, credential validation, mass deployment, victim-specific pivoting and data extraction. Google based that assessment on characteristics including unusually verbose comments, standardised headers and functional but mechanically structured code.

That is evidence of AI-assisted operations, not proof that an autonomous system ran the intrusion. The consequential change is speed. An actor can produce disposable scripts for a particular network, rewrite them when conditions change and coordinate activity across multiple compromised environments without maintaining a large conventional development team.

Trend Micro had previously described overlapping activity as SHADOW-AETHER-064 and documented AI-augmented campaigns against Latin American financial organisations. Mandiant’s newer account adds the payment-system objective, the bespoke malware architecture and forensic evidence of fraudulent transactions.

Hundreds of transactions followed within two days

According to Mandiant, forensic evidence and client reporting showed BREEZE COMET using COBALTSPIN and compromised privileged accounts to reach core financial applications. Within 24 to 48 hours, the actor executed two waves containing hundreds of fraudulent transactions.

Google says the group has completed at least one theft worth tens of thousands of US dollars. It did not disclose the affected organisations, the total attempted value of the transaction waves or how many transfers were successfully settled. Those gaps should remain visible. Hundreds of submitted transactions do not automatically equal hundreds of completed thefts.

What defenders should change

• Protect transactional certificates as privileged identities. Inventory mTLS certificates, restrict where private keys can be used and alert on authentication from unexpected hosts or workflows.
• Separate build authority from payment authority. CI/CD credentials and cloud tokens should not provide an indirect path to payment-system secrets.
• Require independent transaction controls. Rate, value, beneficiary and behavioural checks must remain effective even when an instruction arrives through a technically valid certificate.
• Control remote-management software. Block unapproved portable RMM tools and alert when they execute from user-writable locations.
• Harden branch networks. Use 802.1X, disable unused switch ports and protect network jacks that are accessible in stores or offices.
• Investigate the published indicators. Google supplied hashes, staging domains, detection rules and YARA material for the group’s custom tooling.

The BlackTree view

This was not simply a bank being hacked. It was an attempt to become the bank from the payment system’s point of view.

Mutual TLS, privileged service accounts and API permissions are valuable because they let machines trust one another without stopping for a human decision. BREEZE COMET turned that efficiency into the attack surface. Once the group assembled the right certificate, identity and operational knowledge, the anti-fraud problem moved beyond detecting an unauthorised login. Defenders had to recognise that an authorised channel was issuing unauthorised instructions.

The most important control is therefore not another warning banner for users. It is independent verification around the actions that trusted technical identities are permitted to perform.

Sources

• Google Threat Intelligence Group and Mandiant, Financially Motivated Threat Actor BREEZE COMET Targets Brazil, published 1 September 2026. No publication time was provided.
• Trend Micro, Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America, published 11 May 2026. No publication time was provided.
• The Hacker News, Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems, published 1 September 2026. No publication time was provided.