Beginning in 2024, a financially motivated threat actor designated BREEZE COMET has conducted sophisticated operations targeting Brazilian financial services, retail, and eCommerce organizations. The group specializes in manipulating payment systems including Pix, STR, and Boleto to conduct fraudulent transfers worth tens of thousands of USD. Their evolved tactics leverage customized malware suites written in multiple languages including Rust, Nim, Golang, and Java, alongside compromised government websites for initial access and command and control. The threat actor demonstrates advanced capabilities by targeting banking software, payment APIs, and mTLS credentials while maintaining persistent access through multiple backdoors. Evidence indicates BREEZE COMET uses generative AI to accelerate malware development and script creation, suggesting potential expansion to other Latin American and African countries based on infrastructure replication observed in Nigeria, Paraguay, Ghana, and Venezuela.

Indicators of Compromise

• domain: minacu.go.gov.br
• domain: servicos.salto.sp.gov.br
• url: https://sit.baer.gob.ve/r.exe
• domain: jmcov.gov.py
• domain: sit.baer.gob.ve
• domain: suporte.camaratunapolis.sc.gov.br
• domain: tisup.camaratunapolis.sc.gov.br
• domain: www.mrtb.gov.ng
• hash: 599f80a79efdc584c70f4f763c663b06d432393c
• hash: 51fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce6
• hash: 833368e3029a38a4f87207acd537070e
• hash: d2aa40cc53b40c6e76ac0677c4a54387b3f27ee94c85d9b2c3a3d66aeef92a66
• hash: 3b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceec
• hash: f0cfe3559bf988d4477a6ac2bcc6c025
• hash: 31f578c8d2d51bc91b7dfe4d663cb0ad079d5869
• hash: 6652cf491ed9992eb2f3af23e9641cd987096280
• hash: 0ef9f39b2685b42c78fc6859498b29bf
• hash: f139b4ca15feffb7a6633ec1a431c5c604b397576b56b5c863ae8fe4fa14db4f
• hash: 54e3e03c168899fe9e3ecea2c46b5359
• hash: cd382e301231bb1a86ad06e9d492dbfce6a43fab
• hash: 2214907e696bad85bde1d90c943ef66e413d7a5c6d7596ced25b74441200439a
• hash: 447e3a131e62bd33b1297739a7b959a92358a97f58554469044636a3c4f244e8
• url: https://minacu.go.gov.br/ComprovantePDF.exe
• hash: f25b2229715bd66e783ecde70843f01d
• hash: c23d24b2888d02998f7c0f6091ab2e69fbac4a3e
• hash: 6d4012e0dd3b56a3e52857734fa0d582cdf3c56f0e5decc8005c882d1d1c6ceb
• hash: c0db6ddd6222d02ad7490399d33c61ded0076f0037409dc8498924458646d78a
• url: http://credeb.gov.gn/r.zip
• url: http://gcm.setelagoas.mg.gov.br/files/notepadd.exe
• url: http://gcm.setelagoas.mg.gov.br/files/tes.exe
• url: http://gcm.setelagoas.mg.gov.br/files/ti.zip
• url: http://suporte.ourinhos.sp.gov.br/files/a.exe
• url: http://suporte.ourinhos.sp.gov.br/files/s.zip
• url: http://suporte.ourinhos.sp.gov.br:443/files/s.exe
• url: https://cmgovernadorluizrocha.ma.gov.br/Comprovantepdf.exe
• url: https://conseg.ssp.go.gov.br/COAF-POLICIAFEDERAL.exe
• url: https://conseg.ssp.go.gov.br/ComprovanteBBpix.exe
• url: https://jmcov.gov.py/cxv.exe
• url: https://procon.go.gov.br/ComprovantePDF.exe
• url: https://servicos.salto.sp.gov.br/j.jar
• url: https://suporte.camaratunapolis.sc.gov.br/ti/1.exe
• url: https://suporte.camaratunapolis.sc.gov.br/ti/attvpn.zip
• url: https://tisup.camaratunapolis.sc.gov.br/SoftEther.exe
• url: https://www.mrtb.gov.ng/apps/attvpn.vip
• hash: 08cbd834a5bb5f402d771003f437c206a0a67c6e
• hash: 419df93671ff0eedc118a641bab30584f84d16a6
• hash: 9bd6d2a99a5a63805578d775fdedc7dc2ad765fa
• hash: ea259f3e37f87ddb3d619a7fecb072471af97c3a
• domain: attvpn.vip
• domain: cmgovernadorluizrocha.ma.gov.br
• domain: procon.go.gov.br
• domain: conseg.ssp.go.gov.br
• domain: gcm.setelagoas.mg.gov.br
• domain: suporte.ourinhos.sp.gov.br