Loading story…
Google Threat Intelligence Group has identified BREEZE COMET (formerly UNC5669) as a financially motivated actor targeting Brazilian financial services, retail, and e-commerce organizations to conduct fraudulent transfers. The group seeks access to Brazil's financial transaction ecosystem, including RSFN-connected entities, mutual-TLS credentials, banking and payment APIs, and persistent Active Directory or cloud environments.
BREEZE COMET gains access through voice phishing, password spraying, compromised government websites, rogue hardware on retail networks, and reportedly exploitation of JBoss AS. Its toolset includes XWORM, REALBREEZE, COBALTSPIN, BOATBEAM, and MILDFROST, supplemented by legitimate utilities for reconnaissance, credential theft, lateral movement, tunneling, and data exfiltration. GTIG reported the actor has reused compromised municipal infrastructure in Nigeria, Paraguay, Ghana, and Venezuela, indicating potential expansion across Latin America and Africa, and has evidence of its use of generative AI in malware development.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
In a November 2025 case, BREEZE COMET actors impersonated IT support personnel over WhatsApp and persuaded a victim to install a PowerShell reconnaissance script disguised as a corporate-application update.
By mid-2025, BREEZE COMET used compromised Brazilian small-government websites to host RMM tools, tax- or receipt-themed infostealers, and XWORM. The actor also used the sites as command-and-control endpoints and reused municipal-domain infrastructure across operations.
BREEZE COMET connected rogue hardware devices to retail-store networks to gain initial access, then moved laterally and retrieved post-exploitation frameworks using Netcat and custom scripts.
Mandiant began investigating a string of compromises affecting Brazilian financial-services, retail, and eCommerce organizations. The actor targeted payment systems and banking software to conduct fraudulent transfers.
Reporting disclosed that BREEZE COMET used password spraying, vulnerable JBoss AS servers, RDP/SMB, Impacket, and backdoors including LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM. The group reportedly disabled Windows Defender, used compromised accounts and COBALTSPIN to conduct fraudulent transactions, cleared logs afterward, and carried out at least one theft worth tens of thousands of U.S. dollars.
Reporting identified evidence that BREEZE COMET (UNC5669) uses generative AI to assist malware development. The report also disclosed campaign indicators, including malicious payload-hosting URLs on compromised sites, the dontpad.com domain, and eight associated SHA-256 hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 41 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcecommunity.gurucul.com
Open sourcecloud.google.com
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple malware campaigns targeted users and organizations in Brazil with Latin American banking trojans including **Metamorfo** and **Mispadu/URSA**, using invoice-themed spam, malicious URLs, ZIP archives, MSI installers, and multi-stage loaders to infect Windows systems. Researchers reported delivery chains involving PowerShell, VBScript, AutoIT, and Delphi payloads, as well as abuse of `msiexec.exe`, AWS-hosted infrastructure, and DLL search-order hijacking through a renamed legitimate `VBoxTray.exe` binary that side-loaded a malicious `mpr.dll` file. The malware was built to steal banking credentials and broader account data through keylogging, fake banking pop-ups and overlays, and credential-harvesting tools such as NirSoft utilities, while some variants also sought CVV and two-factor authentication details. Reporting tied the activity to infrastructure largely observed in Brazil, a spam botnet with more than 700 compromised systems and over 4,000 fraudulently created BOL email accounts, and a later campaign that targeted up to 98 Brazilian organizations across IT, professional services, manufacturing, financial services, and government.
Aug 15, 2026
Researchers reported that the **BBTok** banking Trojan has been actively targeting users in **Brazil and Mexico**, impersonating more than 40 banks to steal **2FA tokens**, payment card data, and other banking credentials. The malware campaign uses strong geo-fencing and customized delivery chains that adapt lures to a victim’s country and Windows version, helping operators reduce detection while focusing on regional banking customers. Earlier reporting also documented BBTok activity in Mexico, indicating the malware family has remained active across multiple years. Check Point said the operators rely on layered obfuscation and **living-off-the-land binaries** to deploy payloads, including infection chains that use **LNK files**, a renamed `cmd.exe`, **MSBuild**, SMB-hosted XML, and downloader DLLs such as **Trammy** and **Gammy**. Analysis of older server-side artifacts showed the operation has evolved since at least 2022, with experimentation involving **Follina** and **XLL-based** vectors, while server comments and artifacts suggest with high confidence that the threat actors are Brazilian. The campaign was assessed to have targeted hundreds of users and also supports broader remote-control functions beyond credential theft.
Aug 14, 2026
The **Bizarro** banking Trojan, long associated with Brazilian cybercrime, expanded its operations to victims in **Spain, Portugal, France, Italy, Germany, Argentina, Chile, and Brazil**, broadening a campaign focused on stealing online banking credentials and enabling fraud. Researchers said the malware was delivered through spam emails that pushed victims to download **MSI installers**, which then retrieved additional payloads from compromised websites, hacked WordPress servers, and cloud-hosted infrastructure on **Azure** and **AWS**. Once installed, Bizarro used heavy obfuscation and a backdoor supporting more than **100 commands** to disrupt browser sessions, capture screens, log keystrokes, and hijack clipboard data. The operators also relied heavily on social engineering, displaying fake banking pop-ups, bogus security-update prompts, and requests for **two-factor authentication** codes, while also using malicious **QR codes** that could redirect victims to Android malware to extend the fraud chain beyond desktop systems.
Aug 14, 2026