Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.
- Slim Spider targets cloud credential managers and crypto custody keys
- MikeDor Go backdoor harvests data; spi implant mimics SPI payment infrastructure
- Attack chain spans Azure DevOps, Kubernetes, and Foundry cast tooling
- Breeze Comet executes fraudulent Pix, Boleto, and STR payments since 2024
- Organizations
- CrowdStrikeGoogle Threat Intelligence GroupMandiant
- Countries
- Brazil
From the original article
4 min read at thehackernews.com
A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.