BREEZE COMET Targets Brazilian Financial Networks for Fraudulent Transfers

Google Threat Intelligence Group has identified BREEZE COMET (formerly UNC5669) as a financially motivated actor targeting Brazilian financial services, retail, and e-commerce organizations to conduct fraudulent transfers. The group seeks access to Brazil's financial transaction ecosystem, including RSFN-connected entities, mutual-TLS credentials, banking and payment APIs, and persistent Active Directory or cloud environments.

BREEZE COMET gains access through voice phishing, password spraying, compromised government websites, rogue hardware on retail networks, and reportedly exploitation of JBoss AS. Its toolset includes XWORM, REALBREEZE, COBALTSPIN, BOATBEAM, and MILDFROST, supplemented by legitimate utilities for reconnaissance, credential theft, lateral movement, tunneling, and data exfiltration. GTIG reported the actor has reused compromised municipal infrastructure in Nigeria, Paraguay, Ghana, and Venezuela, indicating potential expansion across Latin America and Africa, and has evidence of its use of generative AI in malware development.