Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Brazilian financial services, retail, and e-commerce organizations
Incident: Unauthorized access and fraudulent transactions via Brazilian banking software and payment APIs.
Impact: Significant financial loss and compromise of core national payment infrastructure.
Attacker: Breeze Comet (UNC5669)
Analysis: Breeze Comet employs a hybrid approach of social engineering and technical exploitation, utilizing password spraying and JBoss AS vulnerabilities for initial access. The group specifically targets mTLS credentials and RSFN access to manipulate payment APIs such as Pix and STR. Their shift toward targeting core financial switches demonstrates a sophisticated evolution in capability and intent.
Recommendations: Enforce strict multi-factor authentication across all administrative and financial system access points; Patch and audit JBoss AS servers to eliminate web shell deployment vectors; Conduct targeted social engineering training to help staff recognize fraudulent IT support impersonation
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source