# Slim Spider Cyber Gang Targets Brazilian Financial Institutions for Crypto Theft Sophisticated attacks exploit cloud vulnerabilities to steal digital asset custody credentials. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-08 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/7610b1ae-50a6-4fd6-afec-ab7c33a44706 ## New Threat Actor Emerges Cybersecurity firm CrowdStrike identified Slim Spider, a previously unknown financially motivated hacking group targeting Brazilian financial institutions since at least March 2026. The group demonstrates deep knowledge of Brazil's financial infrastructure, including the Pix instant payment system and digital asset platforms. Their attacks specifically focus on cloud environments where financial institutions store sensitive credentials. ## Sophisticated Attack Methodology In a March 2026 attack, Slim Spider used custom Bash scripts to query cloud instance metadata and steal temporary credentials. They then accessed cloud credential managers to extract secrets related to digital assets. The group showed advanced operational security by using OpenSSL for cryptographic signing directly in their scripts, avoiding third-party libraries that might trigger detection. ## Ethereum Wallet Compromise After stealing digital asset custody secrets, Slim Spider used Ethereum's Foundry toolkit to derive wallet addresses from stolen private keys. This allowed direct access to cryptocurrency holdings. The attackers moved laterally through cloud container services, deploying backdoors disguised as legitimate infrastructure binaries to evade detection. ## Azure DevOps Exploitation The hackers compromised Azure DevOps to run malicious pipelines that deployed implants across Kubernetes clusters. One implant was named 'spi' to mimic Brazil's Pix payment infrastructure (Sistema de Pagamentos Instantâneos). CrowdStrike found exposed command-and-control panels showing compromised hosts from multiple Brazilian banks and fintechs. ## Additional Malware Tools Slim Spider's arsenal includes MikeDor, a Go-based backdoor that harvests sensitive data and monitors user activity. Their deep understanding of cloud attack surfaces enables targeting of credentials controlling cryptocurrency wallets. Such access can lead to devastating financial losses for victim organizations. ## Parallel Threat: Breeze Comet Another group called Breeze Comet (aka Plump Spider) is also attacking Brazilian financial systems. Active since 2024, they abuse insecure government websites to stage malware and conduct social engineering. The Portuguese-speaking group has expanded operations to Nigeria, Paraguay, Ghana, and Venezuela. ## Payment System Targeting Both groups focus on Brazil's key payment systems: Pix, Boleto, and the Reserves Transfer System (STR). Breeze Comet executes hundreds of fraudulent transactions after breaching systems. The dual targeting of Pix highlights how Brazil's most popular payment method has become a prime cybercrime target. ## Industry-Wide Implications These attacks mark a shift from traditional retail fraud to direct intrusions into core financial infrastructure. The sophisticated capabilities demonstrated by both groups suggest this may become a model for future financial cybercrime in Latin America. Financial institutions must enhance cloud security to protect digital assets. ## Sources covering this story - https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._