A cybercrime group is infiltrating Brazilian financial systems to abuse payment infrastructure and send itself illegal transactions.
Most hackers want money. Most of the time, they get it in some roundabout kind of way. They might convince vulnerable individuals to invest in fake currency exchanges. They might lock up all of a company's files, then hold them for ransom.
"Breeze Comet," formerly known as UNC5669, goes straight to the source. It targets financial institutions: financial services, fintech, retail, point-of-sale (PoS), and e-commerce companies, plus government organizations and banks. Using custom malware and creative infiltration tactics, it pries into the systems that Brazilian financial organizations use to perform transactions and simply initiates payments to itself, for up to tens of thousands of US dollars at a time, according to new research from Google Threat Intelligence Group (GTIG) and Mandiant. Worse, experts warn that this same model might work in many other countries, too.
Getting Into Brazilian Corporate Networks
The earliest Breeze Comet attacks observed by Mandiant, in 2024, began with standard fare intrusion techniques: password spraying, and vishing calls impersonating IT support desks, with the goal of installing remote monitoring and management (RMM) software inside of targeted organizations. These tactics concealed just how sophisticated and motivated it was.