[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fi4oABk5fFqeTfT0Q_eCg0NrYkWT0p9WzveRj5kWqWog":3},{"article":4,"iocs":57,"watch_terms":61,"solutions":62,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"8c923f1c-48c6-43c3-9852-aa054f9434bd","Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution","slim-spider-steals-crypto-custody-secrets-from-brazilian-financial-institution-08a6dd","A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. \"The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment","A new financially motivated threat actor, dubbed Slim Spider by CrowdStrike, is targeting Brazilian financial institutions with advanced cloud-based attacks. The group demonstrates deep knowledge of local financial infrastructure, including the Pix payment system and digital asset platforms. Slim Spider utilizes custom scripts to steal cloud credentials, extract cryptocurrency custody secrets, and deploy backdoors, aiming to compromise accounts and facilitate unauthorized transactions.","Slim Spider targets Brazilian financial institutions with sophisticated cloud attacks.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fslim-spider-steals-crypto-custody.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEim6TzHNI7Stg7pvo_Pu0vMltU2jmnIr922wxLWIYFfaRpN3G7rVZCy76FgWwyZUCT36dRygtzxVmZPFTPSm1FuRrmqXwuvTjJhxwJE7zl34ZHuwZUEDdlrnunlem-Xo7KS6Buy1xlHYYxf-0u-d3qWer-o64MrNvrsh5V1WC7dVtGVwubINEgB1AtfQBNC\u002Fs1600\u002Fbrazil-hackers.jpg","2026-09-08T16:20:23+00:00","2026-09-08T18:00:21.544536+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Slim Spider","threat_actor",{"name":21,"type":22},"CrowdStrike","vendor",{"name":24,"type":25},"Pix","technology",{"name":27,"type":25},"Kubernetes",{"name":29,"type":30},"Ollama","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[58],{"type":51,"value":59,"context":60},"MikeDor","Go-based backdoor used by Slim Spider for information harvesting and user monitoring.",[21,29],{"controls":63,"vendors":147},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":94,"name":95,"problem":96,"products":97},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":123,"name":124,"problem":125,"products":126},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[127,135,142],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":136,"vendor_name":21,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"crowdstrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":143,"product_name":144,"url":145,"description":146},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",[148],{"slug":136,"name":21,"logo_path":137,"roles":149},[150],"reported_by",{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":170},"slim-spider-targets-brazilian-fintechs-to-steal-cloud-credentials-and-crypto-secrets","Slim Spider Targets Brazilian Fintechs to Steal Cloud Credentials and Crypto Secrets","Slim Spider is a sophisticated, financially motivated threat actor exploiting weaknesses in cloud credential management and secrets storage to compromise Brazilian financial institutions. The attackers use custom scripts to harvest cloud credentials and extract cryptocurrency custody secrets — highly sensitive cryptographic material that, once stolen, enables direct and likely irreversible financial theft. This attack highlights the critical danger of storing secrets (API keys, private keys, custody credentials) without adequate protection, rotation, and access controls. The group's deep familiarity with Brazilian-specific infrastructure like Pix amplifies the risk, as attacks can be precisely tailored to maximize financial damage. Organizations that lack robust cloud monitoring and secrets management are essentially leaving the vault door open.",[156,157,158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SC-12: Cryptographic Key Establishment and Management","NIST SP 800-53 SI-4: System Monitoring","NIST CSF DE.CM-1: Network Monitoring","NIST CSF PR.AC-4: Access Permissions Management","GDPR Article 32: Security of Processing","BACEN Resolution 4.893\u002F2021: Cybersecurity Policy for Brazilian Financial Institutions","ITIL Service Security Management: Credential Lifecycle Management",{}]