BREEZE COMET Launches Financially Motivated Attacks in Brazil

Summary

BREEZE COMET is a financially motivated threat actor focused on manipulating payment systems and banking software across Brazil. The group relies on a customized malware toolkit and compromised trusted websites for initial access and command and control. More recently, BREEZE COMET has adopted generative AI to accelerate development of custom reconnaissance and deployment scripts.

Investigation

Mandiant investigated a series of compromises affecting Brazilian financial, retail, and eCommerce organizations beginning in 2024. The investigation uncovered the use of RMM tools, custom Java and Go backdoors, and exploitation of JBoss AS servers. Forensic analysis also confirmed hundreds of fraudulent transactions executed through manipulated payment APIs.

Mitigation

Organizations should enforce strict application control policies and block unauthorized RMM tools from running in user-writable directories. Implementing 802.1X Network Access Control and physical hardware restrictions can help prevent rogue device insertion. Phishing-resistant MFA and PowerShell Constrained Language Mode should also be enforced to strengthen Active Directory and cloud environments.

Response

If BREEZE COMET activity is detected, responders should isolate affected hosts, audit unauthorized scheduled tasks and registry changes, and investigate lateral movement over SMB or RDP. Cloud audit logs should be reviewed for compromised API keys or CI/CD credentials. Organizations should also hunt for unauthorized VPN configurations, proxy infrastructure, and SOCKS5 tunnels.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to establish a persistent, stealthy command-and-control (C2) channel using the COBALTSPIN tunneler. By leveraging Rust-based binaries, they attempt to bypass signature-based AV. The attacker initiates a WebSocket handshake that encapsulates a SOCKS5 proxy. This allows them to tunnel arbitrary traffic through a single, seemingly standard WebSocket connection, effectively bypassing traditional firewall rules that only inspect port 443. The goal is to provide a pathway for lateral movement and data exfiltration.

• Regression Test Script: Since a full Rust compilation of COBALTSPIN is not feasible in a simple script, this simulation uses a Python-based approach to mimic the specific telemetry signature (WebSocket protocol used for SOCKS-like behavior) that the proxy/gateway must log.

  import websocket
  import threading
  import time
  
  # This script simulates the network signature of COBALTSPIN
  # by initiating a WebSocket connection that mimics the 
  # metadata expected by the detection rule.
  
  def simulate_cobaltspin():
      print("[*] Starting COBALTSPIN-style WebSocket Simulation...")
      # In a real environment, the Proxy/Gateway would see 
      # the SOCKS5 handshake within the WebSocket stream.
      # For simulation, we target a local listener or a mock endpoint.
      ws_url = "ws://localhost:8765" 
  
      try:
          ws = websocket.create_connection(ws_url)
          print(f"[*] Connection established to {ws_url}")
          ws.send("SOCKS5-Handshake-Simulation")
          print("[+] Metadata signature generated: TargetType=SOCKS, Protocol=WebSocket")
          time.sleep(5)
          ws.close()
      except Exception as e:
          print(f"[-] Connection failed (Expected if no listener is active): {e}")
  
  if __name__ == "__main__":
      simulate_cobaltspin()

• Cleanup Commands:

  # Terminate any lingering python processes used for simulation
  Stop-Process -Name "python" -Force -ErrorAction SilentlyContinue