Breeze Comet (UNC5669): Defending Brazilian Payment Systems Against a Fraud-Focused Intrusion Actor

---
title: Remote Access Tool Execution on Finance or Payment Operations Workstation
id: 8b2e4a17-3c6f-4d9a-b521-7e0f9d2c4a81
status: experimental
description: Detects execution of commonly abused RMM tools on workstations. Breeze Comet and similar payment-fraud actors use RMM tooling to ride authenticated banking sessions and manipulate payment workflows from the legitimate user's machine.
references:
  - https://thehackernews.com/2026/09/breeze-comet-executes-hundreds-of.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\anydesk.exe'
      - '\rustdesk.exe'
      - '\rustdesk-service.exe'
      - '\screenconnect.client.exe'
      - '\screenconnect.windowsclient.exe'
      - '\splashtop.exe'
      - '\strwinclt.exe'
      - '\atera_agent.exe'
      - '\agentmon.exe'
      - '\teamviewer.exe'
      - '\ammyy.exe'
      - '\supremo.exe'
      - '\netsupportmanager.exe'
      - '\client32.exe'
  filter_known_good:
    CommandLine|contains:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
    CommandLine|contains: 'YOUR_APPROVED_RMM_PATH' # replace with sanctioned deployment path
  condition: selection_image and not filter_known_good
falsepositives:
  - Sanctioned IT support tooling deployed outside standard paths
  - Helpdesk-initiated sessions; maintain an allowlist of approved RMM paths and codes
level: high
---
title: Process Spawned by Brazilian Banking or Payment Application
id: 3f7c91d5-8a42-4e6b-9d13-2b5a6f8c0e47
status: experimental
description: Detects banking or payment software spawning unexpected child processes such as shells, script interpreters, or system utilities. Payment-fraud actors manipulating banking software often trigger commands from within the application session context.
references:
  - https://thehackernews.com/2026/09/breeze-comet-executes-hundreds-of.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\bank'
      - '\banco'
      - '\pagamento'
      - '\payment'
      - '\itau'
      - '\bradesco'
      - '\santander'
      - '\caixa'
      - '\bb.exe'
      - 'warsaw' # Banco Topazio/GAS Tecnologia Warsaw security module path components
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: all of selection_*
falsepositives:
  - Rare; banking security modules (e.g., Warsaw) may spawn limited updater processes — verify by full command line and file path
level: critical
---
title: Suspicious Interactive Session Activity Followed by Network Egress to PIX or Banking Infrastructure
id: 61a0d8c4-5f2b-4e79-a836-9c1d7e4b2f05
status: experimental
description: Detects an RMM process making outbound network connections from a workstation that also communicates with Brazilian banking or payment domains. Co-occurrence of remote-control traffic and banking traffic on the same host is a strong Breeze Comet-style indicator of session riding.
references:
  - https://thehackernews.com/2026/09/breeze-comet-executes-hundreds-of.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: network_connection
  product: windows
detection:
  selection_rmm:
    Image|endswith:
      - '\anydesk.exe'
      - '\rustdesk.exe'
      - '\rustdesk-service.exe'
      - '\screenconnect.client.exe'
      - '\teamviewer.exe'
      - '\supremo.exe'
      - '\splashtop.exe'
    Initiated: 'true'
  condition: selection_rmm
falsepositives:
  - Approved IT remote support sessions; correlate with ticketing system before escalation
level: high

let rmmImages = dynamic(["anydesk.exe","rustdesk.exe","rustdesk-service.exe","screenconnect.client.exe","teamviewer.exe","supremo.exe","splashtop.exe","atera_agent.exe","netsupportmanager.exe"]);
let bankingDomains = dynamic(["itau.com.br","bradesco.com.br","santander.com.br","bb.com.br","caixa.gov.br","nubank.com.br","inter.co","c6bank.com.br","pix.bcb.gov.br","bcb.gov.br","stone.com.br","pagseguro.uol.com.br","mercadopago.com","cielo.com.br","rede.com.br","getnet.com.br"]);
let rmmHosts = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ (rmmImages)
| summarize RMMFirstSeen = min(TimeGenerated), RMMLastSeen = max(TimeGenerated), RMMCommands = make_set(ProcessCommandLine) by DeviceName, FileName;
let bankingHosts = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (bankingDomains)
| summarize BankingConnections = count(), BankingDomains = make_set(RemoteUrl), FirstBanking = min(TimeGenerated) by DeviceName;
rmmHosts
| join kind=inner bankingHosts on DeviceName
| where RMMFirstSeen <= FirstBanking or RMMLastSeen >= FirstBanking
| project DeviceName, FileName, RMMFirstSeen, RMMLastSeen, RMMCommands, BankingConnections, BankingDomains
| sort by RMMLastSeen desc

-- Hunt for RMM tooling and Run-key persistence on payment operations endpoints
LET rmm_paths = ["**/anydesk.exe", "**/rustdesk*.exe", "**/screenconnect*.exe",
  "**/supremo.exe", "**/ammyy.exe", "**/netsupportmanager*/client32.exe"]

LET processes = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(anydesk|rustdesk|screenconnect|supremo|ammyy|splashtop|atera|netsupport|teamviewer)'

LET runkeys = SELECT Name, Data, FullPath
FROM glob(globs=[
  "HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*",
  "HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run/*"
], accessor="registry")
WHERE Data =~ '(?i)(anydesk|rustdesk|screenconnect|supremo|ammyy|splashtop|atera|netsupport)'

LET files = SELECT FullPath, Size, Mtime FROM glob(globs=rmm_paths, accessor="ntfs")

SELECT * FROM processes
UNION ALL
SELECT NULL AS Pid, Name, Data AS CommandLine, FullPath AS Exe, NULL AS Username, NULL AS CreateTime FROM runkeys

# Breeze Comet defensive sweep — run elevated on finance/payment-ops endpoints
$report = [System.Collections.Generic.List[object]]::new()

# 1. Enumerate running and installed RMM tooling
$rmmNames = 'anydesk|rustdesk|screenconnect|supremo|ammyy|splashtop|atera|netsupport|teamviewer'
Get-Process | Where-Object { $_.Name -match $rmmNames } | ForEach-Object {
    $report.Add([pscustomobject]@{ Type='RunningProcess'; Name=$_.Name; Path=$_.Path; Detail='Investigate: RMM active on host' })
}
Get-ChildItem 'C:\Program Files','C:\Program Files (x86)',"$env:LOCALAPPDATA","$env:APPDATA" -Recurse -ErrorAction SilentlyContinue -Include *.exe |
    Where-Object { $_.Name -match $rmmNames } | ForEach-Object {
    $report.Add([pscustomobject]@{ Type='InstalledBinary'; Name=$_.Name; Path=$_.FullName; Detail='Verify against approved software inventory' })
}

# 2. Check Run keys for RMM persistence
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($key in $runKeys) {
    (Get-ItemProperty $key -ErrorAction SilentlyContinue).PSObject.Properties |
        Where-Object { $_.Value -match $rmmNames } | ForEach-Object {
        $report.Add([pscustomobject]@{ Type='RunKeyPersistence'; Name=$_.Name; Path=$key; Detail=$_.Value })
    }
}

# 3. Check services for RMM agents
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match $rmmNames } | ForEach-Object {
    $report.Add([pscustomobject]@{ Type='Service'; Name=$_.Name; Path=$_.PathName; Detail=$_.State })
}

# 4. Output — export for SOC review
$report | Format-Table -AutoSize
$report | Export-Csv "$env:TEMP\breeze-comet-sweep-$(Get-Date -Format yyyyMMdd-HHmm).csv" -NoTypeInformation
Write-Host "[+] Sweep complete. $($report.Count) finding(s). Escalate ANY unapproved RMM to IR immediately." -ForegroundColor Yellow