hacker-news · Crawled Sep 2, 2026

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

1 IoCs 1 Malware
Read original article ↗

AI Summary

Breeze Comet, a financially motivated threat actor active since 2023 and previously tracked as UNC5669, has targeted Brazilian financial, retail, and e-commerce organizations to conduct fraudulent transactions via payment systems like Pix, STR, and Boleto. The group gains initial access through password spraying, social engineering via WhatsApp, and exploitation of vulnerable JBoss AS servers to deploy web shells. They use a suite of custom backdoors such as LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM, along with tools like COBALTSPIN for lateral movement and SOCKS5 tunneling, to maintain persistence and execute hundreds of fraudulent transactions. The actor leverages compromised government websites for C2 infrastructure, disables Windows Defender via PowerShell, and uses LLMs to accelerate malware development, indicating a shift toward more sophisticated, infrastructure-level financial attacks.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware XWorm →

Indicators of Compromise 1 extracted

Type Value Detail
Domain dontpad[.]com Details →

MITRE ATT&CK TTPs 38 techniques

T1006 Direct Volume Access · Defense Evasion T1012 Query Registry · Discovery T1014 Rootkit · Defense Evasion T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1021.002 SMB/Windows Admin Shares · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1055.001 Dynamic-link Library Injection · Defense Evasion T1055.015 ListPlanting · Defense Evasion T1056.001 Keylogging · Collection T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1068 Exploitation for Privilege Escalation · Privilege Escalation T1070.004 File Deletion · Defense Evasion T1070.009 Clear Persistence · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1074 Data Staged · Collection T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1090 Proxy · Command And Control T1090.004 Domain Fronting · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110.003 Password Spraying · Credential Access T1133 External Remote Services · Persistence T1204.002 Malicious File · Execution T1482 Domain Trust Discovery · Discovery T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact T1491 Defacement · Impact T1496 Resource Hijacking · Impact T1548.002 Bypass User Account Control · Privilege Escalation T1557 Adversary-in-the-Middle · Credential Access T1566 Phishing · Initial Access