- The Mess: Breeze Comet is not interested in locking your files or stealing your browser cookies. It wants access to the systems that move money — then it uses legitimate banking infrastructure to send fraudulent transfers.
Google Threat Intelligence Group and Mandiant have been tracking the financially motivated actor, formerly known as UNC5669, since investigations began in 2024.
The targets include Brazilian banks, payment processors, fintechs, retailers, exchanges, e-commerce companies and banking-software providers.
The objective is brutally direct: compromise the organization, reach its payment environment and make the organization transfer its own money.
Breeze Comet has already executed waves of hundreds of fraudulent transactions after compromising privileged accounts and gaining access to core financial applications. In at least one confirmed case, the attackers stole assets worth tens of thousands of dollars.
- The Damage: This attack model bypasses the usual fraud problem because the transaction can originate from a legitimate employee account, legitimate infrastructure and a payment system that believes the request is authorized.
That changes everything.
The attacker doesn’t have to convince a customer to transfer money.
They don’t have to steal a credit card.
They don’t have to deploy ransomware.
They compromise the people and systems that are already allowed to move money.
The Attack Starts Like Ordinary Corporate Compromise
Breeze Comet has used several routes into targeted environments.
Password spraying is one.
Voice calls pretending to be IT support are another.
In some cases, employees were convinced to install legitimate remote-management software such as AnyDesk or SoftEther.
The group has also exploited vulnerable JBoss Application Server installations and used compromised websites to stage malware and tooling.
Once inside, the attackers use normal administrative mechanisms against the environment.
Stolen service accounts.
RDP.
SMB.
PowerShell.
Cloud credentials.
Nothing about that part of the operation requires a Hollywood-grade exploit.
The interesting part comes later.
They Need Access to the Money Plumbing
Breeze Comet is not simply looking for an ordinary corporate workstation.
Its targets have to provide access to payment infrastructure.
Google says the group needs several pieces to make the operation work:
- access to Brazil’s National Financial System Network through a connected organization
- mTLS credentials capable of authenticating transactional requests
- persistent access to multiple Active Directory or cloud accounts
- knowledge of the victim’s transfer-processing procedures
- knowledge of network controls and fintech integrations
- an understanding of anti-fraud systems
Once those pieces line up, the intrusion stops being an IT problem.
It becomes a banking problem.
Four Backdoors Are Better Than One
Breeze Comet also learned an old ransomware lesson without actually deploying ransomware:
Never rely on one way back in.
Mandiant found several custom backdoors operating across compromised environments.
LIGHTPAINT is a Java-based implant that can install and configure SoftEther VPN for persistence.
MILDFROST is another Java backdoor designed around covert DNS tunneling.
KICKPLATE is written in Nim and masquerades as Windows Update Health Tools while delivering additional payloads and supporting SOCKS5 tunneling.
BOATBEAM is a Go-based backdoor that creates a fake IIS HTTPS service on port 443.
Different languages.
Different mechanisms.
Different communication paths.
Remove one implant and another can keep the attackers inside.
Then There Is COBALTSPIN
The group also uses COBALTSPIN, a Rust-based tunneling tool.
Its job is simple: connect the attackers to internal systems that should not be directly reachable from the internet.
COBALTSPIN establishes a reverse SOCKS5 proxy over WebSocket traffic.
That gives Breeze Comet a tunnel into segmented networks and allows the attackers to reach financial APIs and internal services without simply punching holes through the perimeter firewall.
This is where the intrusion becomes particularly ugly.
The firewall may still be working.
Network segmentation may still exist.
The payment application may still be functioning normally.
The attacker is simply operating from inside the trusted zone.
Hundreds of Transactions
Once Breeze Comet obtained privileged access to financial applications, the final stage was fast.
Mandiant’s forensic evidence shows that after establishing the required access, the group could begin fraudulent transactions within roughly 24 to 48 hours.
The attackers executed waves containing hundreds of transfers.
Then they cleaned up.
Event logs were cleared.
Directories created during the intrusion were removed.
Evidence of lateral movement and interactions with financial APIs was deliberately erased.
This is not smash-and-grab cybercrime.
It is an intrusion operation built around understanding exactly how money moves through the victim.
The Malware Is Getting an AI Assist
Google also found evidence that Breeze Comet uses generative AI to accelerate malware development.
Some scripts contain unusually verbose comments and standardized execution headers. Researchers also observed code suggesting LLM assistance with reconnaissance and deployment workflows.
That doesn’t mean an AI independently robbed a bank.
The human operators still control the campaign.
The important part is speed.
An attacker can use an LLM to generate, modify, document and troubleshoot routine components of an operation faster than before.
That compresses the development cycle.
And Breeze Comet already has something more valuable than a fancy malware family:
access to a working financial attack model.
Brazil Is the Test Case
The current activity focuses on Brazilian financial infrastructure, including Pix, STR and Boleto-related systems.
But Google warns that the operational infrastructure may indicate ambitions beyond Brazil, potentially extending into other countries in Latin America and Africa.
That is the part financial organizations outside Brazil should care about.
The specific payment systems may change.
The method doesn’t.
Compromise an organization.
Steal privileged access.
Understand its payment workflow.
Reach the transaction layer.
Abuse legitimate credentials.
Move money.
Delete the evidence.
There is nothing inherently Brazilian about that attack chain.
The Fix
Financial organizations should aggressively protect the accounts and credentials that can initiate transactions.
Use phishing-resistant MFA.
Restrict administrative access.
Lock down RMM software.
Monitor RDP and SMB lateral movement.
Audit cloud credentials and API keys.
Separate payment infrastructure from ordinary corporate networks.
And most importantly, monitor who is actually issuing financial transactions, not merely whether the request was technically authenticated.
A valid credential sending an unusual payment is still an attack.
- The Fix: Lock down privileged payment accounts, enforce phishing-resistant MFA, restrict RMM and lateral movement, protect mTLS/API credentials, and alert on unusual transaction patterns even when the request comes from a legitimate account.
Perimeter security is not enough once the attacker reaches the machine that is authorized to press the payment button.
Bugstoday Opinion
Ransomware crews break the network and ask for money.
Breeze Comet breaks the network and uses the victim’s own payment infrastructure to send it.
That’s a much cleaner business model.
No encryption negotiations.
No ransom portal.
No embarrassing company-wide outage required.
Just stolen credentials, a tunnel into the right network and a payment system that assumes the person holding the keys should be trusted.
The scariest part isn’t the malware.
It’s the workflow.
The attackers learned how the victim moves money — and then made themselves part of that workflow.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Google Threat Intelligence Group / Mandiant — Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Google Cloud — BREEZE COMET Threat Intelligence Report
Mandiant — BREEZE COMET Technical Analysis
The Hacker News — BREEZE COMET Brazilian Payment Systems
Dark Reading — BREEZE COMET Financial Systems Intrusions
