CrowdStrike has publicly attributed a series of intrusions against Brazilian financial institutions to a previously undocumented, financially motivated threat actor it tracks as Slim Spider. Active since at least March 2026, this Brazil-based cluster is not spraying commodity malware at retail banks — it is conducting deliberate, well-informed operations aimed at the cryptographic crown jewels of its victims: crypto custody secrets.
What elevates Slim Spider above the typical regional crime cluster is its operational fluency. According to CrowdStrike, the adversary demonstrates deep knowledge of Brazilian financial infrastructure, including the Pix instant payment system operated by the Central Bank of Brazil. That kind of familiarity doesn't come from OSINT alone — it suggests insiders-turned-operators, locally recruited talent, or operators who have spent significant time inside Brazilian banking environments. For defenders, that changes the math: perimeter-centric controls and generic detections tuned to commodity crimeware will not catch an actor who already knows where your HSMs live, how your custody signing workflow operates, and which service accounts can touch key material.
If your organization operates in — or transacts with — the Brazilian financial sector, particularly in digital asset custody, Pix-connected payment processing, or banking-as-a-service, this threat is directly relevant to you today.
Technical Analysis
Who Is Slim Spider?
Slim Spider is a financially motivated, Brazil-based activity cluster first documented by CrowdStrike in September 2026, with observed activity stretching back to at least March 2026. Key characteristics from the public reporting:
- Targeting: Brazilian financial institutions, with a specific interest in organizations holding or managing cryptocurrency on behalf of clients.
- Objective: Theft of crypto custody secrets — the private keys, seed material, signing credentials, and related secrets that control digital asset wallets. In custody arrangements, compromise of this material is equivalent to irreversible theft; there is no chargeback on-chain.
- Tradecraft: Deep operational knowledge of Brazilian financial infrastructure, including the Pix instant payment ecosystem. This implies familiarity with PIX connectivity requirements, the PKI and certificate workflows mandated by the Central Bank of Brazil, and internal settlement processes — knowledge the actor can leverage both for initial access (highly credible, locally fluent social engineering) and for monetization (rapid, hard-to-reverse fund movement through instant payment rails).
Why Crypto Custody Secrets Are the Target
Traditional banking intrusions face friction: fraudulent wire transfers can be recalled, SWIFT messages can be blocked, and AML controls flag anomalous movements. Cryptocurrency theft bypasses all of it. Once an attacker holds the private key material for a custodial wallet — or enough key shares to reconstruct it — they control the assets absolutely.
Defenders should understand the realistic attack chain for a custody-secret theft operation:
- Initial access — Locally fluent spear-phishing against treasury, custody operations, or PKI/certificate management staff; or compromise of a third party with connectivity into the institution (a supply-chain angle consistent with the actor's infrastructure knowledge).
- Internal reconnaissance — Enumerating where key material lives: HSM partitions and their client configurations, key management system (KMS) databases, certificate stores, encrypted keystore files, backup systems holding key escrow material, and the service accounts authorized to operate signing workflows.
- Credential and secret theft — Dumping credentials (LSASS, DCSync, token theft) to reach custodial systems, then exporting or accessing private keys: certificate export operations (
.pfxextraction), access to keystore files (.jks,.kdb,wallet.dat, encrypted seed backups), or abuse of legitimate HSM/KMS administrative tooling. - Exfiltration and monetization — Staging secrets for exfiltration and, where wallets are directly reachable, initiating fraudulent signing operations. Pix knowledge enables rapid laundering of fiat proceeds through instant payments, where settlement finality works against the victim.
Exploitation Status
This is confirmed, active, in-the-wild intrusion activity — not a theoretical capability. CrowdStrike's disclosure reflects observed operations against real financial institutions over a period of at least six months. No CVE is associated with this reporting; the threat is tradecraft- and access-driven rather than exploit-driven, which means patching alone does nothing here. Defense must be behavioral: identity, key material protection, and detection of the theft mechanics.
The Defender's Core Problem
The uncomfortable truth about custody-key theft is that most of the attack chain uses legitimate administrative functionality — certificate exports, HSM administration, KMS queries, backup access. An actor with valid credentials operating inside documented workflows will not trip signature-based controls. Your detections must therefore focus on context and deviation: who is exporting keys, from where, at what time, to what destination, and whether that identity has ever done this before.
Detection & Response
The detections below target the highest-fidelity observable behaviors in a custody-secret theft chain: private key export, access to keystore artifacts, credential dumping, and anomalous outbound movement from custody infrastructure. Tune allowlists to your environment before deployment.
Sigma Rules
---
title: Private Key or Certificate Export via Windows Tooling
id: 3f8a2c71-9b4e-4d1a-a6c2-7e5f0b8d3a91
status: experimental
description: Detects export of certificates with private keys via certutil or PowerShell, a key behavior in crypto custody secret theft targeting Brazilian financial institutions (Slim Spider).
references:
- https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html
- https://attack.mitre.org/techniques/T1552/004/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.credential_access
- attack.t1552.004
logsource:
category: process_creation
product: windows
detection:
selection_certutil:
Image|endswith: '\certutil.exe'
CommandLine|contains:
- '-exportpfx'
- '-p '
- 'exportpfx'
selection_ps:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- 'Export-PfxCertificate'
- 'Export-Certificate'
- 'PrivateKey.Export'
condition: selection_certutil or selection_ps
falsepositives:
- PKI administrators performing legitimate certificate renewal or migration
- Automated certificate lifecycle management tooling
level: high
---
title: Suspicious Process Access to Crypto Wallet or Keystore Files
id: 8c1d4e62-5a7b-4f39-b2e8-9d0c1a4f6b72
status: experimental
description: Detects file access to cryptocurrency wallet files, Java/HSM keystores, and seed backup artifacts by non-standard processes, consistent with Slim Spider crypto custody secret theft.
references:
- https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html
- https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.credential_access
- attack.t1552
- attack.collection
- attack.t1005
logsource:
category: file_event
product: windows
detection:
selection_paths:
TargetFilename|contains:
- 'wallet.dat'
- '\.keystore'
- '.jks'
- 'seed'
- 'mnemonic'
- '\custody\'
- '\keystore\'
- 'hsm_backup'
- 'keyshare'
filter_legit_processes:
Image|endswith:
- '\explorer.exe'
- '\svchost.exe'
- '\MsMpEng.exe'
- '\java.exe'
- '\javaw.exe'
condition: selection_paths and not filter_legit_processes
falsepositives:
- Backup agents and DLP scanners accessing keystore directories (exclude by service account)
- Legitimate custody application binaries (build an application allowlist)
level: high
---
title: LSASS Memory Access by Non-System Process
id: 5b2e7f14-3c8d-4a61-9e05-1f7b3d9c2a48
status: experimental
description: Detects processes requesting access to LSASS memory, a credential theft precursor enabling lateral movement to crypto custody and HSM administration systems.
references:
- https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html
- https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/09/15
tags:
- attack.credential_access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: '\lsass.exe'
GrantedAccess|contains:
- '0x1010'
- '0x1410'
- '0x143a'
- '0x1fffff'
filter_system:
SourceImage|endswith:
- '\svchost.exe'
- '\MsMpEng.exe'
- '\wininit.exe'
- '\csrss.exe'
condition: selection and not filter_system
falsepositives:
- EDR and AV sensors performing legitimate memory inspection (tune per deployed stack)
level: high
KQL Hunt (Microsoft Sentinel / Defender)
The following query hunts across process execution and file access telemetry for the custody-secret theft chain — key export tooling, keystore file access by non-approved processes, and credential dumping — and is designed to run as a scheduled hunting query against endpoints in financial environments. Tune the ApprovedKeystoreProcesses list to your custody application binaries.
let ApprovedKeystoreProcesses = dynamic(["java.exe", "javaw.exe", "MsMpEng.exe", "svchost.exe", "explorer.exe"]);
let KeyExportProc =
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("exportpfx", "-p "))
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Export-PfxCertificate", "PrivateKey.Export", "Export-Certificate"))
| project KeyExportTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, ProcessId;
let KeystoreAccess =
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("wallet.dat", ".jks", ".keystore", "seed", "mnemonic", "keyshare", "hsm_backup")
or FolderPath has_any ("\\keystore\\", "\\custody\\")
| where not(FileName has "backupcatalog") // reduce backup noise
| where not(InitiatingProcessFileName in~ (ApprovedKeystoreProcesses))
| project FileAccessTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType;
let LsassAccess =
DeviceEvents
| where TimeGenerated > ago(7d)
| where ActionType == "OpenProcessApiCall" and FileName =~ "lsass.exe"
| project LsassTime=TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine;
KeyExportProc
| join kind=outer KeystoreAccess on DeviceName
| join kind=outer LsassAccess on DeviceName
| extend AlertScore = (iff(isnotempty(KeyExportTime), 1, 0)) + (iff(isnotempty(FileAccessTime), 1, 0)) + (iff(isnotempty(LsassTime), 1, 0))
| where AlertScore >= 1
| project DeviceName,
KeyExportTime, FileName, ProcessCommandLine, AccountName,
FileAccessTime, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName1=FileName,
LsassTime, AlertScore
| order by AlertScore desc, DeviceName asc
Analyst note: A single host exhibiting two or more of these behaviors within the same week is a high-priority investigation. Correlate with sign-in telemetry (SigninLogs, AADNonInteractiveUserSignInLogs) for the involved accounts — look for first-time logon sources, impossible travel, or logons to HSM/custody management consoles outside change windows.
Velociraptor VQL Hunt
Deploy this artifact across endpoints — prioritizing custody operations hosts, PKI/certificate servers, and HSM client machines — to collect evidence of key export activity, keystore artifacts, and suspicious outbound connections from server-class systems.
-- Slim Spider hunt: crypto custody secret theft indicators
-- Collects key-export process execution, keystore artifacts, and anomalous outbound connections
-- 1) Live processes running key export or keystore interaction tooling
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(exportpfx|Export-PfxCertificate|PrivateKey\.Export|keytool.*-export|kmip|pkcs11)'
OR Exe =~ '(?i)(mimikatz|procdump|comsvcs.*MiniDump|nanodump|pypykatz)'
-- 2) Keystore and wallet artifacts on disk (run via glob with yara/grep in a full deployment)
-- SELECT FullPath, Size, Mtime FROM glob(globs=['C:\\**\\wallet.dat', 'C:\\**\\*.jks', 'C:\\**\\.keystore'])
-- 3) Outbound connections from server processes that should not browse or transfer
SELECT Pid, Name, Path, Status, Family, Type,
Laddr, Lport, Raddr, Rport
FROM netstat()
WHERE Status =~ 'ESTAB'
AND Name =~ '(?i)(certutil|powershell|pwsh|rundll32|regsvr32|mshta|curl|java)'
AND Raddr !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'
Hardening and Verification Script (PowerShell)
Run this on custody operations workstations, certificate/PKI servers, and HSM client hosts. It enables detailed file-access auditing on keystore directories, verifies restrictive ACLs, and surfaces recent private-key export events for review.
#Requires -RunAsAdministrator
# Slim Spider defensive hardening: crypto custody key material protection
# 1) Identify keystore/custody directories and enable object access auditing
$KeystorePaths = @(
"C:\ProgramData\custody",
"C:\keystore",
"D:\custody"
) | Where-Object { Test-Path $_ }
# Enable 'Audit File System' success+failure (required for SACLs to generate 4663 events)
auditpol /set /subcategory:"File System" /success:enable /failure:enable | Out-Null
foreach ($path in $KeystorePaths) {
$acl = Get-Acl $path
# Audit Everyone: Read, Write, Delete, ChangePermissions on keystore material
$auditRule = New-Object System.Security.AccessControl.FileSystemAuditRule(
"Everyone",
"Read,Write,Delete,ChangePermissions,TakeOwnership",
"ContainerInherit,ObjectInherit",
"None",
"Success,Failure"
)
$acl.AddAuditRule($auditRule)
Set-Acl -Path $path -AclObject $acl
Write-Output "[+] Auditing enabled on: $path"
# Report current ACL for manual review — keystore dirs should be tightly scoped
Write-Output "[*] Current DACL on ${path}:"
(Get-Acl $path).Access | Format-Table IdentityReference, FileSystemRights, AccessControlType -AutoSize
}
# 2) Hunt the last 14 days for private key export and suspicious keystore access events
$start = (Get-Date).AddDays(-14)
Write-Output "`n[*] Certificate export operations (Event 70 / certutil usage):"
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=70; StartTime=$start} -ErrorAction SilentlyContinue |
Select-Object TimeCreated, Message | Format-List
Write-Output "[*] Process executions involving key export tooling (Event 4688):"
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$start} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'exportpfx|Export-PfxCertificate|keytool.*-export' } |
Select-Object TimeCreated, Message | Format-List
# 3) Verify LSASS protection is enabled (RunAsPPL) to raise the bar on credential theft
$ppl = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name RunAsPPL -ErrorAction SilentlyContinue
if (-not $ppl -or $ppl.RunAsPPL -ne 1) {
Write-Output "[!] LSASS PPL NOT enabled. Enable with:"
Write-Output " Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -Value 1"
Write-Output " (Test against your auth stack before enforcing; reboot required.)"
} else {
Write-Output "[+] LSASS RunAsPPL is enabled."
}
# 4) Restrict outbound traffic from custody servers: review for broad egress
Write-Output "`n[*] Review: custody/HSM hosts should have default-deny egress. Current allow rules:"
Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True |
Where-Object { $_.Profile -match 'Domain' } |
Select-Object DisplayName, Profile | Format-Table -AutoSize
Remediation
Because Slim Spider is an intrusion campaign rather than a patchable vulnerability, remediation is about raising the cost of key theft and shortening attacker dwell time. Prioritize the following, in order:
1. Treat custody key material as a tier-zero asset — today.
- Inventory every location where private keys, key shares, seed phrases, HSM partition credentials, and encrypted keystore backups exist — including backups, escrow systems, and disaster recovery copies. You cannot protect what you have not enumerated.
- Enforce MFA (preferably phishing-resistant — FIDO2) and dedicated privileged access workstations for all custody operations, HSM administration, and PKI/certificate management roles. Slim Spider's environment knowledge means it will hunt exactly these accounts.
2. Enforce M-of-N signing and quorum controls.
- Where custody architecture permits, require multi-party approval (M-of-N) for any signing operation or key export, with out-of-band verification for high-value transactions. A single compromised operator credential should never be sufficient to move assets.
- Audit and drill the "break-glass" path — attackers who understand your workflow will target your exception processes first.
3. Constrain key export paths.
- Disable or tightly restrict private key export on certificates and HSM partitions (mark keys non-exportable at generation wherever operationally feasible).
- Alert — do not just log — on any private key export, keystore file access by non-application processes, and HSM administrative session initiation. Route these to the SOC as high-severity.
4. Segment and egress-control custody infrastructure.
- Custody signing systems and HSM clients should sit in dedicated network segments with default-deny egress, accessible only via jump hosts with session recording. There is no legitimate reason for a custody server to initiate arbitrary internet connections.
5. Harden Pix-adjacent workflows against fraud.
- Given the actor's Pix fluency, review transaction anomaly detection on instant payment flows: velocity limits, new-beneficiary cooling periods, and behavioral scoring on treasury-initiated Pix transfers. Instant settlement means your detection window is seconds, not days.
6. Identity detection engineering.
- Deploy the Sigma/KQL content above; baseline which accounts ever perform key exports or HSM administration, and alert on first-time execution of these actions by any identity. An actor operating with stolen-but-valid credentials will be invisible to everything except deviation-based detection.
7. Engage threat intelligence and information sharing.
- Consume CrowdStrike's Slim Spider reporting for actor-specific IOCs and TTPs as they are published, and participate in sector sharing (FS-ISAC or regional equivalents) — Brazilian institutions facing a shared adversary benefit directly from pooled visibility.
If you suspect compromise: isolate custody and signing infrastructure before broad remediation actions that could tip off the actor, preserve forensic images of HSM client hosts and identity systems, and rotate key material under the assumption that anything an attacker could have reached, they did. Key rotation in a custody context is an operational event — plan and rehearse it now, not during an incident.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.