Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution Slim Spider从巴西金融机构窃取加密货币托管机密

TL;DR

• Slim Spider is a previously undocumented financially motivated threat actor linked to attacks on Brazilian financial institutions since at least March 2026, specializing in stealing cryptocurrency custody secrets and instant payment credentials
• The group uses custom Bash scripts to query cloud instance metadata, steal temporary cloud credentials, and exfiltrate digital asset custody secrets, leveraging tools like Foundry's cast and OpenSSL for cryptographic operations
• Slim Spider operates a suite of web-based panels including NEXUS // Scanner (API endpoint scanning with Ollama), Painel de Emails Entra ID (email reconnaissance), and Painel Pix (bulk unauthorized Pix transfer execution)
• The threat actor demonstrates sophisticated cloud-native operational security, deploying backdoors mimicking legitimate infrastructure binaries and impersonating Brazil's Pix payment system through an implant named "spi"
• A parallel threat group, Breeze Comet, is also targeting Brazilian financial systems since 2024, signaling a broader shift from retail fraud to direct intrusions into core payment infrastructure across Latin America

Why It Matters

This disclosure highlights an alarming evolution in cybercrime tactics where financially motivated threat actors are developing deep cloud infrastructure expertise and targeting the credentials that sit closest to high-value digital assets. The convergence of two sophisticated groups (Slim Spider and Breeze Comet) specifically targeting Brazil's Pix instant payment system underscores the growing attractiveness of emerging payment infrastructures as attack surfaces. For AI and security practitioners, this represents a case study in how threat actors are increasingly leveraging cloud-native tooling, custom scripting, and AI-assisted reconnaissance to conduct targeted financial intrusions.

Technical Details

• Cloud Credential Theft: Slim Spider developed custom Bash scripts that query cloud instance metadata services to harvest temporary credentials over socket connections, then used the sed command to clone and modify secret-extracting scripts focused on digital financial asset credentials
• Cryptographic Operations: Rather than using third-party libraries that could trigger detection, the group implemented cloud-native cryptographic signing directly via OpenSSL within Bash scripts and used Foundry's cast tool to derive Ethereum wallet addresses from stolen private keys
• Persistence and Evasion: The actor deployed backdoors mimicking infrastructure-related binaries to blend with legitimate tooling, pivoted through Azure DevOps to run malicious pipelines on managed Kubernetes clusters, and named an implant "spi" to impersonate Brazil's Sistema de Pagamentos Instantâneos (Pix infrastructure)
• AI-Integrated Reconnaissance: NEXUS // Scanner utilizes Ollama to categorize discovered API endpoints into 16 categories (fintech, banking, payment, cryptocurrency) and rank them based on availability and authentication options, demonstrating integration of local LLMs into offensive tooling
• Go-Based Backdoor: MikeDor, a Go-based backdoor in the group's arsenal, is capable of harvesting sensitive information and monitoring user activities, reflecting a trend toward compiled, cross-platform malware frameworks

Industry Insight

• Financial institutions operating in Latin America, particularly those integrated with Pix and similar instant payment systems, should prioritize cloud credential hygiene, metadata service hardening, and continuous monitoring of DevOps pipelines for unauthorized modifications
• The use of Ollama and local LLMs in offensive tooling (NEXUS // Scanner) signals a democratization of AI-powered reconnaissance; security teams should monitor for similar AI-integrated attack tools and update detection rules accordingly
• The shift from retail-level fraud to direct intrusions into core financial switches and payment infrastructure represents a strategic escalation that may replicate across other regions; organizations should treat payment infrastructure credentials with the same severity as cryptographic key material and implement zero-trust principles for cloud environments hosting financial assets

TL;DR

• CrowdStrike追踪到名为Slim Spider的金融动机威胁组织，自2026年3月起针对巴西金融机构发动多阶段入侵，目标是加密货币资产和即时支付账户
• 该组织使用自定义Bash脚本查询云实例元数据窃取临时云凭证，并通过Azure DevOps运行恶意管道在Kubernetes集群部署后门
• 攻击工具链包括基于Ollama的NEXUS // Scanner（API端点扫描）、Painel de Emails Entra ID（邮件侦察）和Painel Pix（批量转账）等自动化面板
• 另一威胁组织Breeze Comet同样针对巴西支付基础设施，标志着拉美网络犯罪从零售欺诈向直接入侵核心金融系统的转变

为什么值得看

本文揭示了网络犯罪组织在云环境和加密货币领域的技术演进，对金融机构和云服务商具有直接的安全参考价值。同时展现了AI工具（如Ollama）被恶意利用的新趋势，为安全从业者提供了重要的威胁情报。

技术解析

Slim Spider采用自定义Bash脚本通过socket连接查询云实例元数据，窃取临时云凭证，并利用sed命令克隆和修改密钥提取脚本，专门针对数字资产凭证。攻击者使用Foundry工具包的cast组件从窃取私钥派生以太坊钱包地址，并通过OpenSSL在Bash脚本中实现云原生加密签名，避免使用第三方库以降低检测风险。

威胁组织部署了多种自动化工具：NEXUS // Scanner使用Ollama将API端点分类为16个类别（金融科技、银行、支付、加密货币等）并排名；Painel de Emails Entra ID搜索 compromised Microsoft 365邮箱；Painel Pix执行批量未经授权Pix转账。MikeDor作为Go语言后门程序可收集敏感信息并监控用户活动。

攻击者还部署了模仿基础设施二进制文件的后门以伪装成合法工具，并在Kubernetes集群中通过恶意管道部署名为"spi"的后门（模仿巴西即时支付系统SPI），体现了对云原生环境的深度理解。

行业启示

金融机构和云服务商需加强云环境凭证管理，特别是针对元数据服务、密钥管理器和容器集群的安全防护，防止临时凭证被窃取。Pix等新兴支付基础设施正成为网络犯罪的高价值目标，需要建立针对性的检测和响应机制。拉美地区网络犯罪模式正从零售欺诈向核心金融系统入侵转变，这种能力升级可能成为其他地区金融犯罪的新模板，行业需警惕并提前布局防御。