Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Google Threat Intelligence details BREEZE COMET, a financially motivated group manipulating Brazilian payment systems and banking software to conduct fraudulent transfers since 2024.
Mandiant and Google Threat Intelligence Group (GTIG) track this activity as BREEZE COMET (formerly UNC5669), active since 2024 against Brazilian financial services, retail, and eCommerce organizations. The actor specializes in manipulating payment systems and banking software to conduct fraudulent transfers. The activity overlaps with operations publicly reported as Plump Spider and SHADOW-AETHER-064. The report details the group's tactics, toolkit, mitigations, and detections for this active and developing threat.
- BREEZE COMET (formerly UNC5669) targets Brazilian financial, retail, and eCommerce organizations since 2024
- Actor manipulates payment systems and banking software to execute fraudulent transfers
- Activity overlaps with publicly reported Plump Spider and SHADOW-AETHER-064 operations
- Report includes TTPs, mitigation recommendations, and detections
- Threat actors
- BREEZE COMETPlump SpiderSHADOW-AETHER-064
- Organizations
- MandiantGoogle Threat Intelligence Group
- Countries
- Brazil
From the original article
Introduction Beginning in 2024 Mandiant investigated a string of compromises affecting Brazilian financial services, retail, and eCommerce organizations. Google Threat Intelligence Group (GTIG) tracks this activity as BREEZE COMET (formerly UNC5669), a financially motivated threat actor specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.
By Google Threat Intelligence Group · cloud.google.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.