Google Threat Intelligence Group and Mandiant published on 1 September 2026 on Breeze Comet, previously tracked as UNC5669, a financially motivated group operating from Brazil and active since at least 2024 — CrowdStrike, which calls it Plump Spider, dates it to September 2023. Trend Micro tracks overlapping activity as SHADOW-AETHER-064.

Four names for one problem is its own small scandal, and we will come back to it.

They went for the rails

Most financial crime targets account holders. This targets the machinery.

Breeze Comet pursues organisations with transaction permissions on Pix, Brazil's instant payment system, on STR, the settlement system, and on Boleto. Google's description of what the group needs is the part that reframes it:

  • Access to the National Financial System Network (RSFN)
  • mTLS credentials for authenticated transaction payloads
  • Privileged Active Directory and cloud accounts
  • An understanding of transfer procedures and anti-fraud systems

That is not a fraudster's shopping list. It is a payments engineer's job description. Google calls it direct intrusion into core financial switch and instant payment infrastructure, and the distinction matters: you cannot defend the rails with the controls built to spot a customer being tricked.

Once inside, the group reaches core financial applications, executes hundreds of fraudulent transactions, and deletes the event logs. Google reports at least one heist of tens of thousands of US dollars in assets — a figure worth flagging as the confirmed floor rather than the scale of the campaign.

The way in is not sophisticated at all

For a group operating inside national payment infrastructure, the entry points are ordinary:

  • Password spraying
  • WhatsApp messages impersonating IT support, to talk someone into installing a remote monitoring tool like AnyDesk
  • Vulnerable JBoss AS servers, for web shells
  • Compromised Brazilian government websites, used to stage RMM tools, infostealers and backdoors

The last one is quietly clever. A payload hosted on a government domain inherits the trust of that domain — in filtering, in reputation systems, and in the mind of whoever clicks it.

But the headline entry method is a WhatsApp message. The most capable part of this operation begins with the oldest trick in the file.

The tooling is custom and the pattern is escalation

COBALTSPIN is a Rust network tunneler that stands up a reverse SOCKS5 proxy over WebSocket, routing between command-and-control and internal targets through the firewall rather than past it.

The backdoors are written in four different languages, which is a hiring signal as much as a technical one:

  • LIGHTPAINT — Java, installs SoftEther VPN
  • MILDFROST — passive Java JAR, DNS tunnelling
  • KICKPLATE — Nim, impersonates Windows Update
  • BOATBEAM — Go, fake IIS HTTPS server

Persistence has escalated year on year: commercial RMM tools in 2024, malicious Kubernetes pods in 2025, custom backdoors now. And the operation has spread beyond Brazil to Nigeria, Paraguay, Ghana and Venezuela.

The LLM claim is thinner than it will be reported

Google indicates LLM-assisted development, and the evidence given is verbose code comments that read like descriptions of self-reasoning and autonomous decision-making.

That is an inference from commenting style. It is plausible — those comments are a recognisable artefact — and it is not proof, and it belongs in the same category as attributing a group by the timezone in its commit metadata. Worth reporting, worth labelling.

Four names, one group

Breeze Comet, UNC5669, Plump Spider, SHADOW-AETHER-064.

Every vendor has reasons for its own naming scheme, and the cost lands entirely on defenders, who have to work out whether three advisories describe three problems or one. If you are searching your logs against a threat name, you are searching against a quarter of the available reporting.

What to do

  • Treat payment-operations staff as your highest-risk identity group. Their credentials are the objective, not a stepping stone.
  • Alert on RMM installs — AnyDesk and equivalents — on any host with access to financial systems. That is the documented first move.
  • Verify IT support contact out of band. The WhatsApp lure works because there is no channel to check it against.
  • Protect mTLS material like signing keys, because that is what it is here.
  • Alarm on event log clearing, which is the group's documented cleanup step and one of the few noisy things it does.
  • Patch or retire JBoss AS. It is the non-social entry point in this campaign.

What is not established

  • The total stolen. One heist of tens of thousands is confirmed; the campaign total is not published.
  • How many organisations were compromised, or which.
  • Whether the LLM assistance is real, beyond an inference from code comments.
  • Whether the four vendor names describe exactly the same set of activity, or overlapping ones.
  • Any nation-state connection. Google characterises this as financially motivated e-crime and nothing more.