Breeze Comet Exploits PIX Transaction Signing Mechanisms within Brazilian Financial Infrastructure

The financially motivated threat actor Breeze Comet (UNC5669) is conducting highly sophisticated attacks against the Brazilian financial sector, specifically targeting the PIX instant payment system. Unlike traditional fraud involving credential theft or forgery, Breeze Comet utilizes specialized modules to manipulate banking software and the transaction signing processes. By exploiting vulnerabilities in how retail e-commerce payment integrations and banking gateways handle transaction signatures, the actor executes hundreds of unauthorized transfers that appear technically valid. This exploitation poses a systemic risk to the integrity of the PIX infrastructure and the broader Brazilian e-commerce ecosystem.

• Campaign Overview: Actor and Targeting
  • Threat Actor: Breeze Comet (formerly tracked as UNC5669).
  • Primary Target: Brazilian financial services, retail, and e-commerce organizations.
  • Motivation: Highly organized, financially motivated operations targeting instant liquidity.
• Attack Mechanics: Transaction Signing Manipulation
  • Core Technique: Sophisticated manipulation of transaction signing processes rather than traditional forgery or spoofing.
  • Exploitation Vector: Targeted manipulation of banking software modules and payment gateway integration points.
  • Payload Characteristics: Custom-engineered modules designed to bypass standard fraud detection by maintaining signature integrity.
• Impact Assessment: Systemic Financial Risk
  • Scale of Loss: Execution of hundreds of successful fraudulent transactions.
  • Infrastructure Threat: Direct risk to the technical integrity and trust model of the PIX instant payment system.
  • Economic Impact: Systemic risk to the stability of the Brazilian retail and e-commerce financial landscape.
• Defensive Posture: Detection and Mitigation
  • Integrity Monitoring: Implement rigorous, real-time checks on the integrity of banking software and signing modules.
  • Integration Audits: Conduct deep-dive security assessments of all retail e-commerce payment integration code.
  • Behavioral Telemetry: Enhance monitoring for anomalous transaction patterns that bypass traditional signature-based fraud detection.