Most payment fraud tries to impersonate a customer. BREEZE COMET goes after the organization that the payment network already trusts.

Google Threat Intelligence Group and Mandiant track the financially motivated actor, formerly UNC5669, across intrusions affecting Brazilian financial services, retail, and e-commerce organizations since 2024. Its objective is not merely to steal account data. It builds access to the applications, identities, certificates, and procedures that can issue legitimate-looking payment instructions at scale.

TL;DR

  • BREEZE COMET targets organizations with access to Pix, STR, boleto processing, banking software, and transactional APIs.
  • The actor seeks privileged Active Directory or cloud accounts, access to Brazil’s financial network, mTLS credentials, and knowledge of payment procedures and fraud controls.
  • Mandiant observed password spraying, service-account abuse, RDP and SMB movement, Kubernetes persistence, custom backdoors, and a Rust SOCKS5 tunnel called COBALTSPIN.
  • In reported cases, fraudulent transaction waves followed access to financial applications within 24 to 48 hours.
  • Defense must verify the intent and context of transactions, not rely on a valid certificate or trusted application alone.

The Real Target Is Transactional Authority

To issue fraudulent transfers, the actor needs several pieces at once: entry to Brazil’s National Financial System Network through an authorized entity, mutual-TLS credentials accepted by transactional services, persistent control of directory or cloud identities, and an understanding of how the victim processes and approves transfers.

That last requirement separates this operation from opportunistic credential theft. Mandiant observed searches for terms such as boleto, cnab, remessa, webhook.*pix, and instant.*payment. The attacker was learning the business process around the payment API, not merely finding a database named “customers.”

Once the right application asks the right security module to authorize the wrong transaction, cryptography can work perfectly and the business can still lose money. A valid signature proves which key approved the request. It does not prove the request reflects an authorized human decision.

How BREEZE COMET Stays Inside

The reported intrusion set is deliberately redundant. BREEZE COMET has used password spraying, compromised service accounts, RDP, SMB, scheduled execution, commercial remote-management tools, malicious Kubernetes pods, and multiple custom backdoors.

COBALTSPIN, written in Rust, provides a reverse SOCKS5 proxy over WebSocket. That lets the operator route traffic through a compromised host toward segmented financial infrastructure. Mandiant also describes LIGHTPAINT, a Java backdoor that installs legitimate VPN software, changes Windows Firewall rules, and activates C2 behavior only when it receives a specific session cookie.

The actor has attempted to disable Microsoft Defender real-time monitoring and clear logs related to movement and payment-system access. Redundant persistence matters because removing the first remote tool may only tell the operator which access path the defender found.

Initial foothold
    -> identity and cloud credential theft
    -> redundant endpoint and Kubernetes persistence
    -> tunnel into segmented payment infrastructure
    -> learn transaction workflows and controls
    -> use trusted applications and credentials for fraudulent transfers

Detect the Business Action

Endpoint detections still matter: Set-MpPreference -DisableRealtimeMonitoring, unexpected VPN installation, new inbound firewall rules, unusual scheduled tasks, and log clearing all deserve investigation. Hunt for new WebSocket connections from servers that do not normally act as proxies and for RDP or SMB sessions initiated by service accounts.

But the decisive telemetry lives closer to the payment. Bind every transaction to the requesting workload, certificate, device, operator, beneficiary, velocity, time, and change history. Alert when a normally stable application begins creating new beneficiaries, sending bursts of transfers, operating outside its normal schedule, or using credentials from a new host.

Require independent approval for high-risk changes and transaction waves. If the same compromised application can define the beneficiary, request the signature, and submit the payment, mTLS authenticates a broken control path.

Defensive Plan: Verify the Payment, Not Just the Credential

OwnerActionWhy it interrupts the attackHow to verify it worked
Payment operationsRequire independent identities for beneficiary creation, payment preparation, approval, and release. Apply step-up approval to new beneficiaries, unusual batches, and velocity changes.A compromised application should not be able to create the destination and approve its own transfer. Separation makes valid application credentials insufficient for fraud.In a test environment, have one role attempt the full transaction chain. The workflow must stop at the independent approval boundary and record both identities.
PKI and HSM teamInventory every transactional certificate, bind its use to approved workloads or HSM policy where supported, remove exported copies, and define rapid revocation and replacement.mTLS proves possession of a certificate, not that the request came from the expected application instance. Workload binding makes a copied certificate less portable.Attempt signing or authentication from an unapproved host. It must fail, while logs tie successful use to the expected certificate, workload, and transaction.
IAM teamReplace shared service accounts, restrict interactive login, scope directory and cloud permissions to the payment task, and alert on RDP or SMB use by non-interactive identities.BREEZE COMET used service accounts for movement. An account that can both run a service and log into unrelated servers turns payment access into lateral movement.Normal service health checks pass; interactive login and access to an unrelated server are denied and create an alert containing the account owner.
Network securityAllow payment applications to reach only required financial endpoints, and detect new WebSocket tunnels, reverse proxies, VPN services, and cross-segment SMB or RDP.COBALTSPIN exists to route attacker traffic through a trusted host and across segmentation. Destination allowlists reduce what that tunnel can reach.From a representative payment workload, verify approved endpoints succeed and a test connection to an unapproved internal and external destination is blocked and logged.
Endpoint and Kubernetes teamsAlert on Defender disabling, new inbound firewall rules, unexpected VPN installation, log clearing, privileged pods, secret reads, and new persistence in payment-connected environments.The actor maintains several access paths. Removing one backdoor without finding endpoint and cluster persistence leaves the payment route recoverable.Run safe detections for each behavior and reconcile every privileged pod, scheduled task, VPN service, and secret access with a deployment or change record.
Fraud and SOC teamsCorrelate endpoint identity with certificate, workload, beneficiary, amount, batch size, time, and change history. Hold transactions when the technical identity is valid but the business pattern is new.Authentication systems can approve an attacker-controlled application. Transaction context detects misuse after the attacker inherits legitimate credentials.Replay an anomalous batch with a new beneficiary and first-seen host. The control must hold or escalate it before settlement and show the full causal context.
Incident commanderPredefine how to suspend one certificate, application, beneficiary, or transaction type without shutting down the entire payment service.Responders delay containment when the only known option stops all revenue or customer payments. Granular isolation makes the safe action operationally usable.Exercise the procedure and measure time to block the test identity while an unaffected payment path continues successfully.

The success criterion is not “the certificate was valid.” It is that no single compromised workload can create, authorize, and release a materially abnormal payment without another control objecting.

BREEZE COMET’s lesson travels beyond Brazil: when attackers inherit the identity of a trusted payment participant, fraud prevention must judge the action, not merely authenticate the channel.

Sources