Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

Slim Spider is a sophisticated, financially motivated threat actor exploiting weaknesses in cloud credential management and secrets storage to compromise Brazilian financial institutions. The attackers use custom scripts to harvest cloud credentials and extract cryptocurrency custody secrets — highly sensitive cryptographic material that, once stolen, enables direct and likely irreversible financial theft. This attack highlights the critical danger of storing secrets (API keys, private keys, custody credentials) without adequate protection, rotation, and access controls. The group's deep familiarity with Brazilian-specific infrastructure like Pix amplifies the risk, as attacks can be precisely tailored to maximize financial damage. Organizations that lack robust cloud monitoring and secrets management are essentially leaving the vault door open.