Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet (formerly UNC5669) since 2024.
Google Threat Intelligence Group (GTIG) and Mandiant teams described the threat actor as "specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers." The adversary is said to have successfully carried out at least one heist of assets worth tens of thousands of U.S. dollars.
The activity overlaps with threat activity clusters tracked by Palo Alto Networks Unit 42, CrowdStrike and Trend Micro under the monikers CL-CRI-1163, Plump Spider and SHADOW-AETHER-064. According to CrowdStrike, the e-crime group is operating out of Brazil and has been active since September 2023, monetizing their intrusions by gaining unauthorized access to internal payment systems and carrying out fraudulent transactions.
Initial access to financial entities and companies offering financial services is accomplished via password spraying and voice calls impersonating IT support teams to persuade targets to install Remote Monitoring and Management (RMM) tools such as AnyDesk. In one case highlighted by Axur in November 2025, the threat actors masqueraded as IT support personnel over a WhatsApp conversation and guided the victim to install a PowerShell reconnaissance script under the pretext of updating a corporate application.
