Slim Spider Cyber Gang Targets Brazilian Financial Institutions for Crypto Theft
Sophisticated attacks exploit cloud vulnerabilities to steal digital asset custody credentials.
1New Threat Actor Emerges
Cybersecurity firm CrowdStrike identified Slim Spider, a previously unknown financially motivated hacking group targeting Brazilian financial institutions since at least March 2026. The group demonstrates deep knowledge of Brazil's financial infrastructure, including the Pix instant payment system and digital asset platforms. Their attacks specifically focus on cloud environments where financial institutions store sensitive credentials.
2Sophisticated Attack Methodology
In a March 2026 attack, Slim Spider used custom Bash scripts to query cloud instance metadata and steal temporary credentials. They then accessed cloud credential managers to extract secrets related to digital assets. The group showed advanced operational security by using OpenSSL for cryptographic signing directly in their scripts, avoiding third-party libraries that might trigger detection.
3Ethereum Wallet Compromise
After stealing digital asset custody secrets, Slim Spider used Ethereum's Foundry toolkit to derive wallet addresses from stolen private keys. This allowed direct access to cryptocurrency holdings. The attackers moved laterally through cloud container services, deploying backdoors disguised as legitimate infrastructure binaries to evade detection.
4Azure DevOps Exploitation
The hackers compromised Azure DevOps to run malicious pipelines that deployed implants across Kubernetes clusters. One implant was named 'spi' to mimic Brazil's Pix payment infrastructure (Sistema de Pagamentos Instantâneos). CrowdStrike found exposed command-and-control panels showing compromised hosts from multiple Brazilian banks and fintechs.
5Additional Malware Tools
Slim Spider's arsenal includes MikeDor, a Go-based backdoor that harvests sensitive data and monitors user activity. Their deep understanding of cloud attack surfaces enables targeting of credentials controlling cryptocurrency wallets. Such access can lead to devastating financial losses for victim organizations.
6Parallel Threat: Breeze Comet
Another group called Breeze Comet (aka Plump Spider) is also attacking Brazilian financial systems. Active since 2024, they abuse insecure government websites to stage malware and conduct social engineering. The Portuguese-speaking group has expanded operations to Nigeria, Paraguay, Ghana, and Venezuela.
7Payment System Targeting
Both groups focus on Brazil's key payment systems: Pix, Boleto, and the Reserves Transfer System (STR). Breeze Comet executes hundreds of fraudulent transactions after breaching systems. The dual targeting of Pix highlights how Brazil's most popular payment method has become a prime cybercrime target.
8Industry-Wide Implications
These attacks mark a shift from traditional retail fraud to direct intrusions into core financial infrastructure. The sophisticated capabilities demonstrated by both groups suggest this may become a model for future financial cybercrime in Latin America. Financial institutions must enhance cloud security to protect digital assets.