Breeze Comet Targets Brazilian Payment Systems with Fraudulent Transfers

Wed, 02 Sep 2026 15:05:08 +0000

Engineer — Skip
SOC/IR — Learn: Breeze Comet (UNC5669) is a financially motivated actor specializing in Brazilian payment and banking software manipulation; the actor profile and TTPs are useful context if your estate includes Brazilian fintech integrations, but no IOCs or detections are surfaced in this item.
Leader — Skip

BREEZE COMET Targets Brazilian Financial Services via Payment API Abuse

Tue, 01 Sep 2026 15:28:52 +0000

Engineer — Learn: Geographically and sector-specific threat with no KEV listing, PoC, or broad exploitation signals; the technique of hijacking trusted websites for C2 and AI-assisted malware development is worth filing for future threat modeling, but requires no immediate change to running systems for most global engineers.
SOC/IR — Plan: Google/Mandiant’s write-up explicitly includes TTPs and detection content — financial-sector SOCs should review the provided detection rules and consider building or tuning coverage for payment API abuse patterns and C2 via compromised legitimate sites this quarter.
Leader — Learn: Useful actor profile for LATAM risk awareness and future board context; no same-week action required unless the organization has direct Brazilian financial operations or depends on Brazilian payment processors.