ctrlINT What the industry said about every indicator, with the quote

BREEZE COMETThreat actor

  • unc5669

BREEZE COMET is a financially motivated threat actor targeting Brazilian financial services, retail, and eCommerce organizations through compromised websites, custom malware, and stolen credentials to manipulate payment systems and execute fraudulent transfers.From MISP Galaxy

Last reported 1 month ago, by Risky Business News2 reports

ATT&CK techniques

6 of 8 · each with the sentence it comes from
  1. T1110.003Password Spraying

    “AWS password spraying campaign: A password spraying campaign has targeted the root user accounts of AWS tenants.”

    Risky Business NewsNews
  2. T1684Social Engineering

    “Spring Ring campaign: A hacking group has targeted more than 150 employees across at least 10 companies as part of a coordinated social engineering campaign.”

    Risky Business NewsNews
  3. T1021.001Remote Desktop Protocol

    “BREEZE COMET abuses standard protocols to navigate the network, using hijacked service accounts to initiate unauthorized Remote Desktop Protocol (RDP) sessions and execute commands via SMB network file shares.”

    Google Threat IntelligenceVendor
  4. T1027.017SVG Smuggling

    “SVG smuggling campaign: Kaseya's INKY team has spotted a massive email spam campaign using SVG smuggling to assemble a phishing page right in the user's browser.”

    Risky Business NewsNews
  5. T1036Masquerading

    “This artifact hides backdoor traffic by masquerading as a legitimate web server, only activating its C2 functionalities when it receives a specific session cookie.”

    Google Threat IntelligenceVendor
  6. T1053.005Scheduled Task

    “The group supplements KICKPLATE by abusing native scheduled tasks (schtasks.exe running as SYSTEM) and malicious shortcut (.lnk) modifications in user startup folders.”

    Google Threat IntelligenceVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

2 reports, newest first · the exact sentence from each

  1. “BREEZE COMET profile: Google has published a profile on BREEZE COMET, an e-crime group that has been targeting organizations tapped into Brazil's payment systems (Pix, STR, and Boleto) since 2024 to steal funds right from the source.”

    Risky Business NewsNews
    Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates

  2. “Financially Motivated Threat Actor BREEZE COMET Targets Brazil”

    Google Threat IntelligenceVendor
    Financially Motivated Threat Actor BREEZE COMET Targets Brazil

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with BREEZE COMET here?
No account needed. We do not store your IP address.