Hackers Breach Brazilian Financial Firms and Execute Hundreds of Fraudulent Transactions

BREEZE COMET is a financially motivated actor that has compromised Brazilian banks, payment processors, retailers, and fintechs to obtain privileged access, mTLS credentials, and transaction-signing authorities allowing the group to submit authenticated fraudulent transfers (including via Pix and STR). The report describes reconnaissance techniques, social engineering, RMM abuse, lateral movement, bespoke implants (COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM, XWORM), evidence of multi-wave frauds, and provides hashes as indicators of compromise along with mitigation recommendations for protecting payment certificates, APIs, and detecting tunneling and unauthorized RMM use.