BREEZE COMET Targets Brazilian Financial Services via Payment API Abuse

Tue, 01 Sep 2026 15:28:52 +0000

Engineer — Learn: Geographically and sector-specific threat with no KEV listing, PoC, or broad exploitation signals; the technique of hijacking trusted websites for C2 and AI-assisted malware development is worth filing for future threat modeling, but requires no immediate change to running systems for most global engineers.
SOC/IR — Plan: Google/Mandiant’s write-up explicitly includes TTPs and detection content — financial-sector SOCs should review the provided detection rules and consider building or tuning coverage for payment API abuse patterns and C2 via compromised legitimate sites this quarter.
Leader — Learn: Useful actor profile for LATAM risk awareness and future board context; no same-week action required unless the organization has direct Brazilian financial operations or depends on Brazilian payment processors.

UNC6671/BlackFile extortion group actively targets financial firms

Fri, 07 Aug 2026 00:21:58 +0000

Engineer — Skip
SOC/IR — Learn: Actor profile useful for financial-sector defenders: UNC6671 is tied to BlackFile and is running an active extortion campaign against hedge funds and PE firms, but no IOCs, TTPs, or detection-ready technical details are available in this item yet.
Leader — Act: If your organization is in financial services, brief leadership now on the active UNC6671 extortion campaign targeting hedge funds and private-equity firms; verify whether your firm has received any suspicious outreach and confirm IR retainer readiness.