Mandiant has detailed a financially motivated operation that deployed four custom backdoors across the same environments, giving the attackers several ways to retain access after defenders removed one foothold. The group’s objective was fraudulent transfers through Brazilian banking software and payment systems.
The Google Threat Intelligence Group and Mandiant said the activity, tracked as BREEZE COMET and formerly as UNC5669, targeted Brazilian financial services, retail, and eCommerce organizations. The research, published Sept. 1, 2026, said the actor had executed at least one fraudulent transfer totaling tens of thousands of dollars.
The four were not variants of one implant. LIGHTPAINT and MILDFROST were written in Java, KICKPLATE in Nim and BOATBEAM in Go, each using a different persistence or communications method.
LIGHTPAINT installed a legitimate VPN, added inbound firewall rules and cleared the associated event logs. MILDFROST hid in the Java virtual machine process space and used slow DNS tunneling as a fallback Command-and-Control (C2) channel.
KICKPLATE impersonated Windows Update Health Tools and persisted through Windows services and registry startup keys. BOATBEAM posed as an IIS web server, activating its control functions only on receiving a specific session cookie.
The redundancy was deliberate. Removing one implant did not establish that an environment was clean, because the next could present as an entirely different class of software or traffic.
Mandiant Also Found AI-Assisted Scripts and Rogue Hardware
Mandiant found evidence the group used LLMs to build scripts for reconnaissance, credential validation, and data extraction. The recovered tooling was functional, but lacked human idiosyncrasies, relying on unrolled code, verbose comments, and standardized headers.
The researchers said generative models compressed the group’s development cycle and lowered the threshold for coordinating attacks across several environments at once. They said defenders should expect shorter adversary turnaround times as a result.
To defend against this and similar threats, Mandiant recommended TLS decryption and Deep Packet Inspection (DPI) instead of domain reputation or government domain allowlists, after finding payloads staged on compromised Brazilian municipal websites. It also recommended 802.1X network access control after rogue hardware was found plugged into retail store networks.
Eviction is therefore broader than removing a known malware family. The operation paired different persistence mechanisms, control channels, and access routes, so defenders would need to close the wider set of footholds rather than treat one implant as the compromise.
