Product

SoftEther VPN

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Aug 17, 2026 · last 7d ago

Timeline2 articles

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.

Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.

The Hacker NewsSep 8, 11:22 UTC · 7d agoThreat actor in the wild

Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.

Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.

Palo Alto Unit 42Aug 17, 10:54 UTC · 29d agoThreat actor in the wild1

Appears with

threat actor Breeze Comet 1 threat actor CL-CRI-1163 1 threat actor GALLIUM 1 threat actor Plump Spider 1 threat actor SHADOW-AETHER-064 1 threat actor Softcell 1 threat actor UNC5669 1 malware BOATBEAM 1 malware COBALTSPIN 1 malware KICKPLATE 1 malware LIGHTPAINT 1 malware MILDFROST 1 malware Reshell 1 malware XWorm 1 malware Zapoa 1 threat actor Alloy Taurus 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.