BREEZE COMET is a financially motivated threat actor operating against Brazilian financial services, retail and eCommerce organisations. The same actor is tracked elsewhere as PLUMP SPIDER, and its activity overlaps with a campaign reported separately as SHADOW-AETHER-064.

Most of the intrusion tradecraft is conventional. The final step is not. Rather than stealing the cryptographic keys that authorise payments, the actor compromises the application permitted to request a signature, injects fraudulent payment data, and lets that application call the hardware security module in the normal way. The instruction reaching the central bank carries a valid signature and passes verification.

In one investigated case, two waves of several hundred fraudulent transactions were executed within 24 to 48 hours of privileged access being established.

Campaign at a Glance

What the Actor Needs to Move Money

Four prerequisites must be met before a fraudulent transfer can execute: access to the National Financial System Network (RSFN) through an entity that already holds it; mTLS credentials permitting authenticated transactional payloads to Pix, STR or a comparable listener; persistent access to multiple Active Directory or cloud accounts; and knowledge of the target's transfer procedures and anti-fraud systems.

The target is the environment where XML pacs.008 payment orders are generated and the institution's digital signature is applied. Once the actor reaches the Pix Gateway, the remaining work is manipulating that application into producing a pacs.008 document containing fraudulent data, then abusing its interaction with the hardware security module.

The architectural consequence is significant. Hardware security modules, key ceremonies and non-exportable key policies control key extraction. They offer no mitigation against an adversary who has compromised an authorised calling application and needs only the ability to request a signature. The key never leaves the module and the signature is genuine, so the fraudulent instruction settles normally. Effective control therefore depends on authorisation and anomaly detection applied to the signing request itself: which identity invoked it, from which host, at what rate, and whether it matches established business patterns.

Initial Access

Entry tradecraft has evolved across three periods, and the vectors are not concurrent.

During 2024, investigators observed password spraying alongside voice calls impersonating internal IT support to induce users to install remote monitoring software. Separate research corroborates the voice phishing and documents insider recruitment, with offers of payment, a share of proceeds, legal representation and laundered funds, directed at managers, IT staff and holders of corporate VPN credentials.

In one recovered engagement, an actor posing as an IT support analyst spent roughly 80 minutes on WhatsApp guiding a victim through downloading and running a reconnaissance script. The remote access tools observed are all legitimate commercial products: AnyDesk, TeamViewer, Supremo, HoptoDesk, RustDesk and SyncroRMM.

From mid-2025 the actor staged payloads on compromised Brazilian municipal and state government websites across Goiás, Maranhão, Minas Gerais, Santa Catarina and São Paulo. Files were disguised as tax and receipt documents, including ComprovantePDF.exe and COAF-POLICIAFEDERAL.exe, the latter referencing Brazil's financial intelligence unit and Federal Police. This use of trusted infrastructure defeated network domain reputation filtering. The same hosts served as both staging locations and command-and-control endpoints across operations against multiple organisations.

In 2025, researchers first observed the actor connect rogue hardware directly into retail store networks. From there it moved laterally and retrieved Netcat alongside custom scripts used to pull post-exploitation frameworks from external open directories. An accessible Ethernet port without 802.1X enforcement bypasses perimeter controls, and network access control is frequently deployed at head offices but not at branches.

Reporting on the overlapping SHADOW-AETHER-064 campaign additionally describes exploitation of vulnerable JBoss AS servers to deploy webshells, through which Chisel and other proxy utilities were pushed.

Privilege Escalation and Reconnaissance

Reconnaissance used Impacket, ADRecon and ADVipscan, downloaded from public repositories and executed in memory via PowerShell to evade file-based detection. The actor also deployed REALBREEZE, a custom LDAP brute-forcing utility.

Escalation extends beyond Active Directory into development and cloud environments, with the actor mining CI/CD pipelines for hard-coded credentials, API keys and privileged cloud access tokens.

Custom scripts enumerate host files and environment variables for the mTLS credentials and administrative certificates needed to authenticate against core banking systems, searching for boleto, cnab, remessa, webhook.*pix and instant.*payment. Those terms are directly usable for hunting across build logs, environment configuration and repository history.

Persistence and Command and Control

In 2024 the actor relied on commercial remote management software. In 2025 it added malicious Kubernetes pods to hold cloud persistence and exfiltrate secrets to public notepad services such as dontpad[.]com. Investigators subsequently identified five custom backdoors providing redundant access across four programming languages.

Endpoint defences were disabled directly via Set-MpPreference -DisableRealtimeMonitoring $true. After the transfers executed, event logs were cleared to obscure lateral movement, privilege escalation and financial API interaction, and directories created during the intrusion were deleted.

This redundancy matters for incident response: remediating a single family will not evict the actor.

Attribution and Naming

The three designations describe overlapping but not identical activity. One assessment asserts the mapping directly, listing SHADOW-AETHER-064 and BREEZE COMET as community identifiers for PLUMP SPIDER. The primary reporting is more qualified, stating only that its activity overlaps with the other designations and reserving strict identity for UNC5669.

The technical reporting diverges accordingly. The BREEZE COMET material documents six custom families and initial access via voice phishing, government-domain staging and rogue hardware. The SHADOW-AETHER-064 material documents a different toolset, POW and SOCKTZ, initial access via JBoss AS exploitation, and an objective of data exfiltration. Neither references the other's malware family names. Treat the designations as a correlated cluster and ingest indicators from both.

Activity dating also differs: one assessment places the actor as active since at least September 2023, while the primary reporting dates its investigations to 2024. The earlier date originates in a single source and should be qualified accordingly.

Assessed Use of Large Language Models

Reporting on both clusters assesses that large language models accelerated development of custom scripts for reconnaissance, credential validation, mass deployment and data extraction. Both assessments are inferential, resting on stylistic evidence: scripts that are functional and highly customised but lack human idiosyncrasies, relying on unrolled code structures, verbose comments and standardised execution headers.

The SHADOW-AETHER-064 research reached the same conclusion from iterative reasoning strings left in attack scripts, but could not identify the service abused.

One point is reported incorrectly elsewhere: a specific LLM service was identified, but only in relation to SHADOW-AETHER-040, a separate Spanish-speaking campaign clustered apart from 064. That identification does not extend to BREEZE COMET.

The operational conclusion matters more than the attribution question. AI agents accelerate attacks but cannot create vulnerabilities that are not already present, and researchers observed campaigns that failed despite agentic tooling because segmentation held.

Geographic Scope

Equivalent staging activity was observed on government domains in Nigeria, Paraguay and Venezuela, assessed as possible intent to expand the actor's infrastructure footprint. The evidence is compromised staging infrastructure, not confirmed victims in those jurisdictions, and a separate assessment still places targeting as primarily Brazil-based.

One inconsistency is worth correcting. The narrative text lists Ghana, but the corresponding indicator is credeb[.]gov[.]gn, and .gn is Guinea rather than Ghana (.gh). No .gh indicator appears in the report. The error originates in the primary source and has been reproduced in later coverage.

Attributable Loss

The primary reporting confirms one theft of tens of thousands of USD. This is the only loss figure attributable to the actor.

Two larger Brazilian payment incidents are frequently discussed alongside this actor and should not be. Two larger Brazilian incidents are frequently discussed alongside this actor and are attributed to it by no primary source. A June 2025 compromise of a payment technology provider, with loss estimates from US$72 million upward, drew one published comparison to PLUMP SPIDER, but that is a hedge rather than attribution, and the same analysis documents insider bribery as a competing explanation.

A second incident in August 2025, affecting a financial software provider, involved approximately R$710 million in unauthorised transactions, of which roughly R$589 million was blocked or recovered. That headline figure is transaction volume, not net loss.

Indicators of Compromise

Indicators are defanged and must be re-fanged before use. Hashes are SHA-256.

The BREEZE COMET reporting published no command-and-control addresses; the network infrastructure above comes from SHADOW-AETHER-064 hunting queries. Infrastructure associated with SHADOW-AETHER-040 should be excluded as a separate campaign.

The artefacts below support hunting where file hashes have rotated or are unavailable.

Legitimate tooling observed includes Netcat, Chisel, Neo-reGeorg, ProxyChains, CrackMapExec, Impacket, ADRecon and ADVipscan, alongside the six remote management products named above.

Four YARA rules covering REALBREEZE, COBALTSPIN, BOATBEAM and MILDFROST were published alongside the primary reporting. Two of them, G_Tunneler_COBALTSPIN_1 and G_Backdoor_BOATBEAM_1, are gated on absolute file-offset ranges and will silently stop matching after any recompilation or repacking, so both should be treated as build-specific rather than family-generic. The string-based REALBREEZE and MILDFROST rules are more durable. Published hunting content also covers DNS connections to paste services, PowerShell DownloadString with suspicious arguments, and PowerShell loading .NET assemblies, all straightforward to reimplement in any SIEM.

Detection and Response

Controls are ordered by effectiveness against the tradecraft above rather than by framework category.

• Monitor the signing request, not the key. Alert on deviations in pacs.008 signature request patterns: rate, timing, source host, batch size and beneficiary novelty. Signature validity provides no detection value here. Monitor HSM administrative operations such as key creation, permission changes and export attempts, and restrict which hosts and service identities may invoke signing at all.

• Isolate the payment path. Domain controllers, HSMs and PKI should be unreachable from general-purpose workstations and standard VPN pools. Apply Layer 7 micro-segmentation around financial workloads, block workstation-to-server SMB and RDP, and restrict administrative access to PAM-brokered jump hosts.

• Size transaction controls to a 48-hour window. Out-of-band verification thresholds should assume compromise to execution takes one to two days, not weeks.

• Enforce phishing-resistant MFA and govern RMM. Phishing-resistant MFA addresses both the voice phishing and password spraying vectors. Maintain an approved RMM inventory and alert on anything outside it, since the tools abused are legitimate commercial products. Establish a verified callback procedure for any support request involving software installation.

• Constrain in-memory execution. Enable PowerShell Constrained Language Mode, Script Block Logging under Event ID 4104, and AMSI. Restrict ntdsutil.exe and vssadmin.exe, and alert on volume shadow copy creation and deletion.

• Do not allowlist government domains. Apply TLS decryption and deep packet inspection independently of source reputation. Block outbound ICMP and tunneling utilities, and monitor for outbound WebSocket to non-business destinations, anomalous DNS volume to delegated subdomains, and access to public paste services from server segments.

• Deploy 802.1X at branch and retail sites. Network access control on physical ports is the primary control against rogue hardware and is frequently absent outside head offices. Disable unused ports and secure publicly accessible drops.

• Audit CI/CD and container workloads. Search repository history, build logs and environment configuration against the actor's own search terms. Implement centralised secrets management, scope pipeline identities to least privilege, and rotate cloud tokens. Enforce Kubernetes RBAC, admission control and egress policies preventing pod access to paste services.

Finally, internet-facing JBoss AS instances should be patched or decommissioned and Java application servers checked for JSP webshells. Because the backdoor architecture spans four runtimes, remediating a single family will not remove the actor.