Emerging ‘Slim Spider’ Group Targets Brazilian Banks’ Crypto Custody Systems

A previously unknown cyber‑crime collective identified as Slim Spider has been linked to a series of intrusions against Brazil’s financial institutions, with activity dating back to at least March 2026. The group’s focus on cryptocurrency custody platforms has raised alarms among banks and regulators, highlighting a new vector for financially motivated attacks in the region.

According to cybersecurity firm CrowdStrike, Slim Spider’s operations appear to be driven by the theft of digital asset credentials and the subsequent illicit movement of crypto holdings. The attackers have repeatedly targeted the backend systems that safeguard client wallets, seeking to exfiltrate private keys and authentication data that grant direct access to high‑value cryptocurrency accounts.

CrowdStrike’s threat‑intel team coined the moniker Slim Spider after observing a consistent set of tactics, techniques, and procedures across multiple incidents. The investigators noted a pattern of spear‑phishing emails, exploitation of unpatched server software, and the deployment of custom malware designed to evade conventional endpoint detection. By correlating indicators of compromise across different banks, the firm was able to map the group’s operational footprint and confirm its Brazil‑based origins.

The emergence of this threat actor comes at a time when Brazil’s banking sector is expanding its crypto‑related services, responding to growing consumer demand for digital assets. Financial institutions have been integrating custodial solutions to hold cryptocurrencies on behalf of clients, a move that inevitably expands the attack surface for cyber‑criminals seeking lucrative payouts. Historically, Brazilian banks have faced a range of cyber threats, but the focus on crypto custody marks a shift toward higher‑value, less regulated targets.

Banking executives and regulators have begun to tighten security protocols in response. Measures under consideration include mandatory multi‑factor authentication for all custodial operations, accelerated patch‑management cycles, and heightened monitoring of network traffic for anomalous behavior. Industry groups are also urging the adoption of zero‑trust architectures to limit lateral movement within internal networks.

Analysts warn that Slim Spider may evolve its tactics as defenses improve, potentially targeting third‑party service providers that support custodial platforms. Ongoing collaboration between private security firms, financial institutions, and law‑enforcement agencies will be crucial to disrupt the group’s infrastructure and mitigate future losses. The episode underscores the broader challenge of securing emerging financial technologies against organized cyber‑crime.