Posted on

BREEZE COMET Financial Intrusions and Custom Tunneling Malware

Threat Overview

Google Threat Intelligence Group and Mandiant published new research on BREEZE COMET, formerly UNC5669, a financially motivated threat actor targeting Brazilian financial services, fintech, retail, e-commerce, government, and banking environments. The actor has used password spraying, IT-support vishing, RMM software, compromised trusted government websites, service-account abuse, RDP, SMB, custom tunneling, Kubernetes persistence, custom Java/Nim/Golang malware, firewall changes, scheduled tasks, and event-log clearing. The group ultimately targets payment systems and APIs to execute fraudulent transactions and has shown signs of expanding infrastructure beyond Brazil.

References

Impacted Systems

Targeted environments: financial services, fintech, retail, e-commerce, banks, payment processors, government, and organizations with access to banking/payment APIs. Platforms observed include Windows, Active Directory, cloud environments, Kubernetes, and enterprise networks. Initial access has included password spraying, vishing, RMM installation, compromised trusted websites, and rogue physical network devices. Post-compromise tooling includes AnyDesk, XWORM, COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM.

Why this matters

The campaign is an active financially motivated intrusion set with a clear path from identity compromise to remote access, lateral movement, persistence, tunneling, and fraudulent payment activity. Its behaviors generalize well to MSSP detection across customers even outside Brazil.

Criticality: High

Exploitation Status

Confirmed active threat activity based on multiple Mandiant investigations beginning in 2024 and continuing through 2026. GTIG reports successful fraudulent-transfer activity and ongoing development.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for password spraying, RMM execution, RDP and SMB activity, scheduled task/startup persistence, firewall rule modification, event-log clearing, and suspicious tunneling or rare outbound connectivity where the relevant sources are ingested.

Required logs

  • Microsoft Defender XDR / Defender for Endpoint tables: DeviceProcessEvents and DeviceNetworkEvents
  • Microsoft Entra ID sign-in telemetry in SigninLogs
  • Windows Security Events in SecurityEvent, including 4624 and 1102

First Pass – RMM and Vishing Follow-On Activity

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("AnyDesk.exe", "ScreenConnect.ClientService.exe", "TeamViewer.exe", "rustdesk.exe", "splashtop-streamer.exe") or ProcessCommandLine has_any ("AnyDesk", "ScreenConnect", "TeamViewer", "RustDesk", "Splashtop")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA1
| order by TimeGenerated desc

Password Spray and Multi-IP Authentication Failures

SigninLogs
| where TimeGenerated > ago(14d)
| where ResultType != 0
| summarize Attempts=count(), Users=dcount(UserPrincipalName), IPs=dcount(IPAddress), UserList=make_set(UserPrincipalName,20) by IPAddress, bin(TimeGenerated, 15m)
| where Attempts >= 20 and Users >= 5
| order by TimeGenerated desc

Suspicious RDP From New Sources

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 4624 and LogonType == 10
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hosts=dcount(Computer), Events=count() by Account, IpAddress
| order by LastSeen desc

SMB and Network Discovery Tooling

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("net view", "net use", "nltest", "dsquery", "arp -a", "route print", "Get-SmbShare", "Get-NetTCPConnection") or FileName in~ ("net.exe", "nltest.exe", "dsquery.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Scheduled Task and Startup Persistence

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("schtasks.exe", "reg.exe", "powershell.exe", "cmd.exe")
| where ProcessCommandLine has_any ("/create", @"\Run", @"\RunOnce", "Startup", "schtasks")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Defender Firewall Rule Modification

DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("netsh.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("advfirewall", "New-NetFirewallRule", "Set-NetFirewallRule", "firewall add rule")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Event Log Clearing

SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID == 1102
| project TimeGenerated, Computer, Account, SubjectUserName, SubjectDomainName
| order by TimeGenerated desc

Suspicious Outbound Tunneling From Compromised Hosts

DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe", "java", "powershell.exe", "pwsh.exe", "ssh.exe", "plink.exe", "socat", "cloudflared.exe")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Ports=make_set(RemotePort,20) by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Connections desc

Detection Notes

Highest signal comes from unexpected RMM usage, new RDP sources, SYSTEM scheduled tasks, firewall rule changes, event-log clearing, and tunneling processes on endpoints that do not normally perform those actions. Exact custom-malware filenames and IOCs can change, so behavior should remain primary. Financial transaction fraud itself may not be visible in Sentinel unless payment/application telemetry is ingested.