Product

Azure DevOps

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 27, 2026 · last 7d ago

Timeline2 articles

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.

CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.

The Hacker NewsSep 8, 16:20 UTC · 7d agoThreat actor in the wild

Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps

Wiz published a DFIR cheatsheet covering log visibility, incident readiness, and threat hunting across GitHub, GitLab, Bitbucket, and Azure DevOps.

Wiz researchers released a practitioner's guide to version control system forensics, incident response, and threat hunting. The cheatsheet maps log sources, audit capabilities, and hunting workflows across GitHub, GitLab, Bitbucket, and Azure DevOps. It aims to improve incident readiness for source code and CI/CD compromise scenarios.

Wiz BlogAug 27, 12:00 UTC · 19d agoResearch1

Appears with

threat actor Breeze Comet 1 threat actor CL-CRI-1163 1 threat actor Plump Spider 1 threat actor SHADOW-AETHER-064 1 threat actor Slim Spider 1 malware MikeDor 1 malware spi 1 organization CrowdStrike 1 organization Google Threat Intelligence Group 1 organization Mandiant 1 organization Wiz 1 product Bitbucket 1 product Foundry 1 product GitHub 1 product GitLab 1 product Kubernetes 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.