Financially Motivated Threat Actor BREEZE COMET Targets Brazil

BREEZE COMET is a financially motivated cyber threat actor that has conducted advanced operations targeting Brazilian financial institutions and related sectors since early 2024. Their tactics include manipulation of key Brazilian payment systems (Pix, STR, Boleto) to execute fraudulent financial transfers. The group uses customized malware suites developed in multiple programming languages (Rust, Nim, Golang, Java) and compromises government websites to establish initial footholds and command and control infrastructure. They focus on exploiting banking software, payment APIs, and mutual TLS credentials to maintain persistent access through multiple backdoors. Notably, BREEZE COMET employs generative AI to enhance malware and script creation efficiency. Evidence suggests potential geographic expansion to Nigeria, Paraguay, Ghana, and Venezuela, indicating a broader regional threat. There are no known public exploits or patches related to this threat, as it is an active adversary campaign rather than a software vulnerability.

The threat actor conducts fraudulent financial transfers worth tens of thousands of USD by manipulating Brazilian payment systems, causing direct financial losses to targeted organizations. Their persistent access and advanced malware capabilities increase the risk of ongoing fraud and potential data compromise within affected institutions. The use of compromised government websites for initial access also indicates a risk to public sector infrastructure. Expansion to other countries could broaden the impact regionally.

No specific patches or fixes apply as this is an active threat actor campaign rather than a software vulnerability. Organizations should follow threat intelligence advisories and implement targeted defenses against the tactics described, such as monitoring for unusual payment system activity, securing banking software and payment APIs, protecting mTLS credentials, and hardening web infrastructure against compromise. Since the vendor advisory or authoritative source does not provide explicit remediation steps, organizations should consult the referenced threat intelligence reports for detailed mitigation strategies.