Scope - What This Guide Covers
This guide focuses on the shift from retail banking fraud to direct intrusions into core financial infrastructure, as seen in Breeze Comet's attacks on Brazilian payment systems since 2024. You'll find specific advice for securing payment APIs, financial software, and the access points that attackers exploit to execute fraudulent transactions through systems like Pix, STR, and Boleto.
This isn't about consumer-facing phishing or card-not-present fraud. It covers adversaries who compromise your internal payment processing infrastructure, steal mutual TLS credentials, and execute transactions as if they were legitimate operators.
Key Concepts and Definitions
National Financial System Network (RSFN): The backbone network connecting Brazilian financial institutions. Access requires authorization through an entity already connected to the network.
Mutual TLS (mTLS) credentials: Cryptographic certificates that authenticate both client and server in payment API transactions. If compromised, attackers can send authenticated transaction orders that payment systems will accept as legitimate.
Payment system targeting: Direct manipulation of core payment infrastructure (Pix, STR, Boleto) rather than compromising individual cardholder accounts. The threat actor operates at the institutional level.
LLM-assisted malware development: The use of large language models to accelerate custom tooling development. According to Google Threat Intelligence Group, verbose explanatory comments and standardized execution headers in Breeze Comet's code suggest LLM usage to speed up development.
Requirements Breakdown
Breeze Comet's operations require four elements. Your defense strategy should focus on denying at least one:
1. RSFN Network Access
The adversary must compromise an entity already authorized to connect to the National Financial System Network. This access can't be obtained externally.
Defense priority: Monitor all entities with RSFN access privileges. Implement network segmentation that isolates RSFN-connected systems from general corporate infrastructure.
2. mTLS Credentials for Payment APIs
Without valid mutual TLS credentials, the attacker can't send authenticated transaction orders to Pix or STR systems.
Defense priority: Treat mTLS private keys like Key Encryption Keys (KEKs). Store them in hardware security modules, rotate them regularly, and log every authentication event that uses them.
3. Multiple Active Directory and Cloud Environment Accounts
Breeze Comet uses tools like REALBREEZE (a custom LDAP brute-forcing utility), Impacket, ADRecon, and ADVipscan to compromise privileged accounts across on-premises and cloud environments.
Defense priority: Implement Role-Based Access Control (RBAC) with least privilege. Monitor for unusual LDAP queries and lateral movement via Remote Desktop Protocol (RDP) or SMB file shares.
4. Knowledge of Internal Transfer Procedures
The adversary must understand your transfer processing workflows, network controls, fintech integrations, and anti-fraud systems to execute transactions that bypass detection.
Defense priority: Limit documentation of complete end-to-end transaction flows to need-to-know personnel. Implement Multi-Factor Authentication (MFA) for access to procedure documentation and configuration management systems.
Implementation Guidance
Secure Your Initial Access Vectors
Breeze Comet gains entry through password spraying, social engineering via voice calls and WhatsApp (impersonating IT support to install RMM tools like AnyDesk), and exploiting vulnerable JBoss AS servers.
Your checklist:
- Deploy MFA on all accounts with access to financial systems
- Establish out-of-band verification procedures for IT support requests
- Block unauthorized RMM tool execution through application control policies
- Patch internet-facing application servers within 14 days of critical vulnerability disclosure
- Monitor for web shell deployment on public-facing servers
Detect Persistence Mechanisms
The threat actor has evolved from commercial RMM tools in 2024 to deploying malicious Kubernetes pods and multiple custom backdoors in 2025. They've used LIGHTPAINT (Java-based, installs SoftEther VPN), MILDFROST (passive DNS tunneling), KICKPLATE (Nim-based, impersonates Windows Update tools), and BOATBEAM (creates fake IIS HTTPS servers on port 443).
Detection approach:
- Monitor for unauthorized VPN configurations, especially SoftEther installations
- Inspect DNS query patterns for tunneling behavior
- Validate that Windows Update processes match known-good hashes
- Identify unexpected services listening on port 443
- Alert on PowerShell commands that disable Windows Defender real-time monitoring
Monitor Financial API Interactions
COBALTSPIN, a Rust-based routing malware, establishes reverse SOCKS5 proxies over WebSocket connections to route traffic between command-and-control infrastructure and internal payment APIs. This allows the adversary to bypass boundary firewalls.
Monitoring requirements:
- Log every API call to payment systems with full context (source account, destination account, amount, timestamp, originating IP)
- Establish baseline transaction patterns for each authorized user and system
- Alert on WebSocket connections originating from financial API servers
- Implement network segmentation testing to verify payment API isolation
- Review firewall rules quarterly to identify unnecessary pathways
Common Pitfalls
Pitfall 1: Treating Cloud Secrets as Low-Risk Assets
Breeze Comet exfiltrates cloud secrets to public-facing notepad sites like dontpad[.]com. If your cloud credentials provide access to payment systems or RSFN-connected infrastructure, their compromise is equivalent to losing mTLS certificates.
Pitfall 2: Assuming Retail Fraud Defenses Scale to Infrastructure Attacks
Your transaction monitoring rules designed to catch consumer card fraud won't detect an adversary executing hundreds of fraudulent transactions using legitimate privileged accounts and valid mTLS credentials. You need monitoring that detects anomalous behavior from authorized systems.
Pitfall 3: Underestimating Physical Access Risk
The threat actor connects rogue hardware directly into retail store networks to establish footholds. If your retail locations connect to the same network segments as your payment processing infrastructure, a compromised point-of-sale terminal becomes a pathway to core financial systems.
Pitfall 4: Ignoring Compromised Government Websites as C2 Infrastructure
Breeze Comet stages malware on compromised small government websites in Brazil, Nigeria, Paraguay, Ghana, and Venezuela. These domains bypass reputation filters because they're legitimate government properties. Your network security controls must inspect traffic to government domains, not whitelist them automatically.
Quick Reference Table
| Requirement | Breeze Comet Capability | Your Control |
|---|---|---|
| RSFN Access | Compromise authorized entity | Network segmentation, access monitoring |
| mTLS Credentials | Steal certificates from compromised hosts | HSM storage, certificate rotation, authentication logging |
| Privileged Accounts | LDAP brute-forcing (REALBREEZE), lateral movement via RDP/SMB | RBAC, MFA, lateral movement detection |
| Process Knowledge | Reconnaissance of transfer workflows and anti-fraud systems | Least Privilege, procedure documentation controls |
| Persistence | Custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM) | Endpoint detection, unauthorized service monitoring |
| Command & Control | COBALTSPIN routing malware, compromised government websites | WebSocket monitoring, traffic inspection regardless of domain reputation |
| Transaction Execution | API access via compromised accounts and stolen mTLS credentials | Transaction pattern analysis, API call logging, behavioral baselines |
The shift from retail fraud to core financial infrastructure attacks means your fraud detection framework must now monitor for threats operating with legitimate credentials at the system level, not just suspicious consumer transactions at the account level.
