BREEZE COMET Hackers Use AI-Assisted Malware to Target Brazil Banks for Fraudulent Transfers

BREEZE COMET (aka UNC5669) is an active financially motivated threat actor targeting Brazilian banks, payment rails (Pix, STR, Boleto) and retail/commerce systems to fraudulently submit transfers via trusted channels. The group uses credential attacks, voice phishing, compromised public sites and rogue hardware to gain access; deploys custom malware and tunneling tools (COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM) often accelerated by generative AI for discovery and credential testing; and has executed rapid fraudulent transaction waves within 24–48 hours. The report includes IoCs (SHA-256 hashes, malicious URLs, filenames, domains) and actionable defensive guidance for remote management controls, network access controls, cloud secret hygiene and monitoring indicators like suspicious PowerShell, DNS tunneling and unexpected payment API activity.