BREEZE COMET Threat Group Exploits Payment Systems in Brazil, Initiates Hundreds of Fraudulent Transactions

Cyber‑security analysts have identified a financially motivated group known as BREEZE COMET as the source of a series of coordinated breaches affecting banks, retailers and online merchants across Brazil. The attackers gained privileged access to internal payment platforms and, in rapid succession, launched multiple waves of fraudulent transfers that together amounted to several hundred illicit transactions.

Investigations reveal that the intruders leveraged compromised credentials to move laterally within target networks, eventually reaching the core processing systems that handle customer payments. By operating from within trusted environments, the group was able to bypass many conventional security controls, allowing the fraudulent payouts to appear as legitimate transfers.

The campaign appears to be part of a broader trend of threat actors targeting the Latin American financial sector, where high transaction volumes and fragmented security practices present attractive opportunities. While the precise timeline of the attacks remains under review, analysts note that the wave‑like pattern of the fraudulent moves suggests a tightly choreographed effort designed to overwhelm detection mechanisms and cash out before alarms could be raised.

Brazilian regulators and law‑enforcement agencies have been alerted, and affected institutions are conducting forensic reviews to determine the full scope of the breach. The incidents underscore the importance of robust privileged‑account management, continuous monitoring of payment workflows, and rapid incident‑response capabilities in an environment where cyber‑crime groups increasingly focus on direct monetary gain.

Security firms recommend that organizations review access rights, implement multi‑factor authentication for critical systems, and deploy real‑time transaction analytics to spot anomalous activity. As investigations continue, stakeholders are watching for potential links between BREEZE COMET and other recent intrusion campaigns, which could signal a coordinated push to exploit vulnerabilities across multiple sectors in the region.