[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEfDVuM3VyWjQ-S9397qY0C8RAC_MwYYCR7aE0SQNBv4":3},{"article":4,"iocs":49,"watch_terms":56,"solutions":57,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"14c2c0a6-90b8-4690-9b00-88cf40dd9128","Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems","breeze-comet-executes-hundreds-of-fraudulent-transactions-via-brazilian-payment--dff23f","Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024. Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as \"specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers.\" The adversary","A financially motivated threat actor known as Breeze Comet (formerly UNC5669) has been targeting Brazilian financial services, retail, and e-commerce organizations since 2024. The group specializes in manipulating payment systems to conduct fraudulent transfers, having already executed hundreds of transactions and at least one heist worth tens of thousands of dollars. Their tactics include password spraying, social engineering via voice and messaging apps, exploiting vulnerable JBoss AS servers, and using compromised websites for C2 infrastructure.","Breeze Comet targets Brazilian financial systems with fraudulent transactions.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fbreeze-comet-executes-hundreds-of.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgvGVdje0roDTqKcU541FTx34ODDmuBU-qtwYwoW0-qAYscD9yX5stIs8EhQtC7gnwM4WpqNTjYFRRwXm7w97C5tY7eEhCQJ89Y_uesRzrbbuR7knHdEkoDetSlRpfa8XOD_rdChE5yFh3VtBPlChgYRKp9ZDon-0B1_VAM9NOd0_xvgw9gD_YF7lSBXiPI\u002Fs1600\u002Fbrazil.jpg","2026-09-01T17:19:24+00:00","2026-09-01T20:00:11.521762+00:00",8,[17,20,22,24,26,29],{"name":18,"type":19},"Breeze Comet","threat_actor",{"name":21,"type":19},"UNC5669",{"name":23,"type":19},"Plump Spider",{"name":25,"type":19},"SHADOW-AETHER-064",{"name":27,"type":28},"AnyDesk","product",{"name":30,"type":28},"JBoss AS","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,53],{"type":35,"value":51,"context":52},"XWorm","Backdoor used by Breeze Comet",{"type":35,"value":54,"context":55},"Chisel","Proxy utility used by Breeze Comet",[27,30],{"controls":58,"vendors":146},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":89,"name":90,"problem":91,"products":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":173},"breeze-comet-exploits-weak-auth-and-unpatched-servers-to-steal-from-brazilian-payment-systems","Breeze Comet Exploits Weak Auth and Unpatched Servers to Steal from Brazilian Payment Systems","Breeze Comet demonstrates how a combination of weak authentication practices and unpatched legacy infrastructure creates a devastating attack surface for financially motivated threat actors. The group's success with password spraying indicates that organizations lacked strong multi-factor authentication and account lockout policies, while exploitation of vulnerable JBoss AS servers reflects chronic patch management failures on internet-facing assets. Using compromised websites as command-and-control infrastructure allowed the attackers to blend into normal traffic, evading detection for long enough to execute hundreds of fraudulent transactions. This case matters because payment system fraud causes direct, quantifiable financial harm and erodes customer trust in digital financial services across an entire sector.",[158,159,160,161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 AC-7: Unsuccessful Logon Attempts","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 IA-5: Authenticator Management","NIST Cybersecurity Framework DE.CM-7: Monitoring for Unauthorized Activity","PCI DSS Requirement 6: Develop and Maintain Secure Systems","PCI DSS Requirement 8: Identify Users and Authenticate Access","ITIL Change Management: Emergency Patching Procedures","MITRE ATT&CK T1110.003: Password Spraying","MITRE ATT&CK T1190: Exploit Public-Facing Application",{}]