Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
29 IOCs

Financially Motivated Threat Actor BREEZE COMET Targets Brazil

Google Threat Intelligence (GTIG / Mandiant)
Google Threat Intelligence (GTIG / Mandiant)
Published September 1, 2026Original Report

Threat Actors

Malware Families

Excerpt

Introduction Beginning in 2024 Mandiant investigated a string of compromises affecting Brazilian financial services, retail, and eCommerce organizations. Google Threat Intelligence Group (GTIG) tracks this activity as BREEZE COMET (formerly UNC5669), a financially motivated threat actor specializing in manipulating payment systems and banking software in Brazil to conduct fraudulent transfers. This activity overlaps with operations publicly reported as Plump Spider and…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYUNC5669INFRASTRUCTUREhttp://gcm.setelagoas…https://minacu.go.gov…http://suporte.ourinh…CAPABILITYChiselImpacketMETA StealerVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(4)
Victim

Indicators of Compromise

Open the mindmap →

29 indicators

TypeIndicatorConfidenceScoreFirst Seen
URLhttp://gcm.setelagoas.mg.gov.br/files/ti.zipHighScore 58/100First seen
URLhttps://minacu.go.gov.br/ComprovantePDF.exeHighScore 58/100First seen
URLhttp://suporte.ourinhos.sp.gov.br:443/files/s.exeHighScore 58/100First seen
SHA256c0db6ddd6222d02ad7490399d33c61ded0076f0037409dc8498924458646d78aMediumScore 53/100First seen
SHA25651fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce6HighScore 85/100First seen
URLhttps://jmcov.gov.py/cxv.exeHighScore 58/100First seen
SHA256f139b4ca15feffb7a6633ec1a431c5c604b397576b56b5c863ae8fe4fa14db4fMediumScore 53/100First seen
URLhttp://gcm.setelagoas.mg.gov.br/files/notepadd.exeMediumScore 45/100First seen
URLhttp://suporte.ourinhos.sp.gov.br/files/s.zipHighScore 58/100First seen
URLhttps://cmgovernadorluizrocha.ma.gov.br/Comprovantepdf.exeHighScore 58/100First seen
SHA256de4e533c9062c62b3ba3a5d88eff111156075f2c92d243737edeead6481a9fd5MediumScore 53/100First seen
SHA256d2aa40cc53b40c6e76ac0677c4a54387b3f27ee94c85d9b2c3a3d66aeef92a66HighScore 85/100First seen
URLhttps://tisup.camaratunapolis.sc.gov.br/SoftEther.exeHighScore 58/100First seen
URLhttps://sit.baer.gob.ve/r.exeHighScore 58/100First seen
Domaindontpad.comLowScore 32/100First seen
SHA2566d4012e0dd3b56a3e52857734fa0d582cdf3c56f0e5decc8005c882d1d1c6cebMediumScore 53/100First seen
URLhttps://www.mrtb.gov.ng/apps/attvpn.vipHighScore 58/100First seen
URLhttps://servicos.salto.sp.gov.br/j.jarHighScore 58/100First seen
URLhttps://suporte.camaratunapolis.sc.gov.br/ti/attvpn.zipHighScore 58/100First seen
URLhttps://conseg.ssp.go.gov.br/ComprovanteBBpix.exeHighScore 58/100First seen
URLhttp://suporte.ourinhos.sp.gov.br/files/a.exeHighScore 58/100First seen
URLhttps://suporte.camaratunapolis.sc.gov.br/ti/1.exeHighScore 58/100First seen
URLhttp://gcm.setelagoas.mg.gov.br/files/tes.exeMediumScore 45/100First seen
URLhttp://credeb.gov.gn/r.zipHighScore 58/100First seen
SHA256447e3a131e62bd33b1297739a7b959a92358a97f58554469044636a3c4f244e8MediumScore 53/100First seen
SHA2562214907e696bad85bde1d90c943ef66e413d7a5c6d7596ced25b74441200439aMediumScore 55/100First seen
URLhttps://conseg.ssp.go.gov.br/COAF-POLICIAFEDERAL.exeHighScore 58/100First seen
URLhttps://procon.go.gov.br/ComprovantePDF.exeHighScore 58/100First seen
SHA2563b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceecHighScore 85/100First seen

IOC Relationship Graph

Building graph…