In 2025 a criminal crew began plugging rogue hardware devices straight into the networks of Brazilian retail stores, buying a foothold no phishing email could. Google's Mandiant has tracked the group since 2024 and named it publicly on 1 September in a report on the campaign: BREEZE COMET, a financially motivated operation that breaks into Brazilian banks, payment processors, retailers and fintech suppliers, then uses the victims' own systems to move money out. Mandiant says it has landed at least one heist of tens of thousands of USD in assets.
The prize is not data. It is Brazil's payment plumbing: access to the National Financial System Network through an organization that already has it, plus the mTLS credentials that let it send authenticated transfer orders to Pix, the country's instant payment system, and STR, the reserves transfer system. Hold both and you can move money in a real institution's name.
The money leaves within two days
Once BREEZE COMET reached core financial applications through hijacked privileged accounts, it executed two waves of hundreds of fraudulent transactions within 24 to 48 hours, based on reporting by a Mandiant client and third party forensic analysis. It then cleared event logs across the compromised hosts and deleted the directories it had created. Google Threat Intelligence Group (GTIG) says the activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064.
Hacked town halls host the malware
From mid-2025 the group staged its tools on compromised small Brazilian government websites, which is how executables dressed up as tax documents and payment receipts came to be served from municipal gov.br domains. Trusted infrastructure walks straight past the reputation filters that would flag an unknown host. GTIG found the same pattern on municipal domains in Nigeria, Ghana, Paraguay and Venezuela, a spread it reads as possible intent to expand beyond Brazil. Earlier access came from password spraying and from calls impersonating IT support to talk staff into installing remote management tools such as AnyDesk. Axur corroborates the voice phishing and reports insider recruitment attempts, and Trend Micro has reported JBoss AS exploitation.
Four languages, four back doors
BREEZE COMET built its toolkit rather than renting one. COBALTSPIN, written in Rust, opens a reverse SOCKS5 proxy over a WebSocket so traffic can cross internal firewalls. Four custom backdoors then provide redundant access: LIGHTPAINT installs a legitimate VPN such as SoftEther and clears the Windows VPN plugin event logs afterwards, MILDFROST hides inside a Java virtual machine and takes instructions over slow DNS queries, KICKPLATE, written in Nim, impersonates Windows Update Health Tools, and BOATBEAM, written in Go, runs a fake IIS HTTPS server on port 443 that only activates on a specific session cookie. The crew also mines build pipelines and cloud environments for the certificates that authenticate against core banking systems, using search terms that are the vocabulary of Brazilian payments: boleto, cnab, remessa, webhook.*pix and instant.*payment.
The scripts read like nobody wrote them
GTIG also found evidence the group used large language models to build its tooling: the recovered scripts are highly customized and functional, the researchers write, but lack human idiosyncrasies, relying on unrolled code structures, verbose explanatory comments and standardized execution headers. A Brazilian access broker was recently found working the same way, as covered in our report on BRAZETSU.
Lock the network jacks, not just the laptops
GTIG's hardening advice starts where the intrusions did. Deploy 802.1X network access control on physical switch ports at branch and retail sites so an unauthorized device cannot reach internal subnets, and disable unused ports. Block execution from user writable directories, audit for portable remote management tools, and train staff on IT support impersonation. Because the crew hides behind hacked government sites, run TLS decryption and deep packet inspection on outbound traffic instead of trusting domain reputation or .gov allowlists, and move secrets into a managed vault.
Selected indicators, defanged: staging URL hxxps://procon[.]go[.]gov[.]br/ComprovantePDF[.]exe, exfiltration to dontpad[.]com, and COBALTSPIN sample 3b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceec. The report carries the full list and YARA rules.
The shift matters beyond one country. Latin American cybercrime has historically meant high volume fraud aimed at bank customers, one account at a time. BREEZE COMET goes at the switch itself, and GTIG expects the approach to serve as a model for financially motivated groups across the region.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.