01-09-2026
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
https://cloud.google.com/blog/topics/threat-intelligence/financially-motivated-threat-actor-breeze-comet-targets-brazil/
Report completeness: High
Actors/Campaigns:
Breeze_comet (motivation: financially_motivated)
Plump_spider
Threats:
Password_spray_technique
Anydesk_tool
Xworm_rat
Netcat_tool
Impacket_tool
Adrecon_tool
Realbreeze_tool
Cobaltspin
Tunneler
Shadow_copies_delete_technique
Chisel_tool
Gsocket_tool
Victims:
Financial services, Retail, Ecommerce, Banks, Payment processors, Exchanges, Fintech, Banking software providers, Government organizations
Industry:
Healthcare, Retail, Government, E-commerce, Financial
Geo:
Africa, Latin american, Brazilian, Paraguay, Venezuela, Latin america, Ghana, Brazil, Nigeria
TTPs:
Tactics: 3
Technics: 0
ChatGPT TTPs:
do not use without manual checkT1021.001, T1021.002, T1036, T1046, T1053.005, T1059.001, T1059.004, T1070.001, T1070.004, T1071.001, have more...
IOCs:
File: 5
Domain: 1
Hash: 8
Url: 19
Soft:
Active Directory, JBoss, Kubernetes, SoftEther, Windows Defender Firewall, Windows Defender, LINUX, Outlook, macOS, Gatekeeper, have more...
Functions:
Set-MpPreference
Languages:
golang, powershell, rust, java
YARA: Found
