SLIM SPIDER breaches Brazilian financial institution's cloud to steal credentials and stage mass unauthorized Pix transfers
CrowdStrike reports that the cybercriminal group SLIM SPIDER breached a Brazilian financial institution in late March 2026 to obtain credentials and information tied to digital assets. The group did not attack Pix or the Central Bank directly. It targeted the cloud environments that banks and fintechs use. CrowdStrike also recorded a 171% rise in cybercrime activity aimed at cloud environments. An exposed web control panel listed compromised systems of Brazilian banks and fintechs, and panel functions included preparing mass unauthorized Pix transfers. The report does not say whether any transfers were completed, what losses resulted, or how many institutions were affected.
Detalhes técnicos
- The actors used custom scripts to obtain temporary cloud access credentials, then searched for sensitive data and extracted at least six secrets whose names suggested a link to digital financial assets.
- They moved into the institution's software development environment and installed malicious tools. One was named "spi", which may refer to the Central Bank's Instant Payment System (SPI) behind Pix, but this link is unconfirmed.
- Web-accessible control panels automated tasks: mapping target banking and payment services, searching compromised mailboxes, and preparing mass unauthorized Pix transfers from compromised accounts.
- The group used valid credentials, legitimate services and malicious files disguised as common infrastructure components, so its activity resembles routine system administration and is harder to detect.
Remediação
CrowdStrike recommends that financial institutions:
- Limit access permissions.
- Protect and rotate credentials.
- Review service accounts.
- Monitor changes in cloud and development environments.
- Correlate logs across identity, device, cloud and development telemetry.
Linha do tempo
-
SLIM SPIDER breaches Brazilian financial institution's cloud to steal credentials and stage mass unauthorized Pix transfers
ler a análise desta fonte ocultar
CrowdStrike reports that the cybercriminal group SLIM SPIDER breached a Brazilian financial institution in late March 2026 to obtain credentials and information tied to digital assets. The group did not attack Pix or the Central Bank directly. It targeted the cloud environments that banks and fintechs use. CrowdStrike also recorded a 171% rise in cybercrime activity aimed at cloud environments. An exposed web control panel listed compromised systems of Brazilian banks and fintechs, and panel functions included preparing mass unauthorized Pix transfers. The report does not say whether any transfers were completed, what losses resulted, or how many institutions were affected.
Technical Details
- The actors used custom scripts to obtain temporary cloud access credentials, then searched for sensitive data and extracted at least six secrets whose names suggested a link to digital financial assets.
- They moved into the institution's software development environment and installed malicious tools. One was named "spi", which may refer to the Central Bank's Instant Payment System (SPI) behind Pix, but this link is unconfirmed.
- Web-accessible control panels automated tasks: mapping target banking and payment services, searching compromised mailboxes, and preparing mass unauthorized Pix transfers from compromised accounts.
- The group used valid credentials, legitimate services and malicious files disguised as common infrastructure components, so its activity resembles routine system administration and is harder to detect.
Remediation
CrowdStrike recommends that financial institutions:
- Limit access permissions.
- Protect and rotate credentials.
- Review service accounts.
- Monitor changes in cloud and development environments.
- Correlate logs across identity, device, cloud and development telemetry.