FINANCIALLY MOTIVATED THREAT ACTOR BREEZE COMET TARGETS BRAZIL

Summary from the TLDR InfoSec newsletter

Since 2024, BREEZE COMET has targeted Brazilian banks, payment firms, retailers, exchanges, and fintech providers to make fraudulent Pix, STR, and Boleto transfers. Initial access included password spraying, fake IT-support calls, booby-trapped tax files, exposed JBoss servers, and rogue devices on retail networks. The group steals mTLS credentials, API keys, CI/CD secrets, and cloud tokens, then moves through SMB and RDP. Its toolkit includes REALBREEZE, COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM. Mandiant recorded two transaction waves within 24-48 hours after access to core financial applications.