Full Report
A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates deep operational knowledge of Brazilian financial infrastructure, including the instant payment
Analysis Summary
# Threat Actor: Slim Spider
## Attribution & Identity
* **Actor Name:** Slim Spider
* **Origin:** Brazil-based
* **Tracking Organization:** CrowdStrike
* **Associations:** Noted as a previously undocumented financially motivated e-crime cluster. The article briefly mentions a separate group, **Breeze Comet** (aka Plump Spider, CL-CRI-1163), which also targets the Brazilian financial sector, though they are distinct entities.
## Activity Summary
Slim Spider has been active since at least March 2026. The actor specializes in sophisticated intrusions against Brazilian financial institutions, demonstrating a "deep operational knowledge" of the local financial ecosystem. Their recent operations involve multi-stage cloud intrusions designed to exfiltrate cryptocurrency private keys and perform unauthorized bulk transfers via instant payment systems.
## Tactics, Techniques & Procedures
* **Cloud Metadata Exploitation:** Use of custom Bash scripts to query cloud instance metadata via socket connections to steal temporary credentials.
* **Credential Enumeration:** Listing and extracting secrets from cloud credential managers.
* **Environment Manipulation:** Utilizing native Linux tools like `sed` to clone and modify scripts within the victim environment.
* **Cloud-Native Cryptography:** Implementing cryptographic signing directly via **OpenSSL** within Bash scripts to avoid detection triggered by third-party libraries.
* **Blockchain Interaction:** Utilizing `cast` (from the Foundry Ethereum toolkit) to derive wallet addresses from stolen private keys.
* **Defense Evasion:** Deploying backdoors that mimic legitimate infrastructure binary names to blend with normal system activity.
* **CI/CD Pipeline Abuse:** Pivoting to **Azure DevOps** using compromised credentials to run malicious pipelines that deploy implants across managed Kubernetes clusters.
* **Impersonation:** Naming malware ("spi") to mimic legitimate infrastructure components like the *Sistema de Pagamentos Instantâneos*.
## Targeting
* **Sectors:** Financial Services, Fintech, Cryptocurrency Platforms, Banking.
* **Geography:** Brazil.
* **Victims:** Brazilian financial institutions and digital asset platforms.
## Tools & Infrastructure
* **MikeDor:** A Go-based backdoor used for harvesting sensitive information and monitoring user activity.
* **NEXUS // Scanner:** An API endpoint-scanning panel utilizing **Ollama** (AI) to categorize and rank targets (fintech, banking, etc.).
* **Painel de Emails Entra ID:** A reconnaissance panel for searching compromised Microsoft 365 mailboxes.
* **Painel Pix:** A specialized transaction panel for executing bulk unauthorized Pix (Brazilian instant payment) transfers.
* **Foundry/Cast:** Ethereum developer toolkit used for wallet derivation.
* **C2 Panels:** Exposed command-and-control panels used for managing compromised hosts and exfiltrated archives.
## Implications
Slim Spider represents a significant escalation in the technical maturity of Brazilian e-crime. Their move from traditional banking trojans to cloud-native attacks—targeting Kubernetes clusters, Azure DevOps pipelines, and digital asset custody secrets—indicates that financial threat actors are now matching the sophistication of APT groups in cloud environments. Their ability to automate the exploitation of the Pix payment system poses a direct systemic risk to the Brazilian financial infrastructure.
## Mitigations
* **Cloud Credential Security:** Restrict access to cloud instance metadata services (IMDS) and enforce the use of IMDSv2.
* **Secret Management:** Implement strict IAM policies and monitoring for cloud secret managers (e.g., AWS Secrets Manager, Azure Key Vault).
* **CI/CD Security:** Enforce Multi-Factor Authentication (MFA) for Azure DevOps and monitor for unauthorized pipeline modifications or deployments.
* **Kubernetes Hardening:** Audit managed Kubernetes clusters for unauthorized containers and ensure infrastructure binaries are verified via integrity checks.
* **Transaction Monitoring:** Implement behavioral analytics to detect bulk or anomalous Pix transaction patterns originating from automated panels.