Breeze Comet Exploits Brazilian Payment Systems for Financial Fraud

Breeze Comet, a financially motivated threat actor, has executed hundreds of fraudulent transactions in Brazil by exploiting payment systems through tactics like password spraying and compromised RMM tools. The group leverages advanced techniques, including custom malware and LLM-driven code, to bypass security measures and target financial institutions, with potential expansion into Latin America and Africa.

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.

Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as "specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers." The adversary

Read original article