VulnHub

Real-time Cybersecurity News

Critical

'Breeze Comet' Tears Into Brazilian & Global Financial Systems

darkreading
Actively Exploited

Overview

A Brazilian cybercrime group known as 'Breeze Comet' is reportedly exploiting vulnerabilities in the country's financial systems to siphon money directly into their accounts. This group has gained recognition as one of the most sophisticated threat actors in Brazil, showcasing their ability to manipulate financial transactions and evade detection. Their activities not only threaten the integrity of Brazilian financial institutions but also pose a risk to global financial systems interconnected with Brazil. As they continue to operate undetected, the potential for widespread financial loss increases, raising concerns among regulators and financial institutions alike. This incident serves as a stark reminder of the ongoing risks posed by cybercriminals in the financial sector.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Brazilian financial systems, global financial networks
  • Action Required: Companies should enhance security measures, conduct regular audits, and implement real-time transaction monitoring.
  • Timeline: Ongoing since [timeframe]

Original Article Summary

Brazil's most sophisticated threat group is making light work of the country's financial systems, putting money directly into its own pocket.

Impact

Brazilian financial systems, global financial networks

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since [timeframe]

Remediation

Companies should enhance security measures, conduct regular audits, and implement real-time transaction monitoring.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

Attackers exploit zero-days in consistently besieged SonicWall product

CyberScoop

SonicWall's SMA 1000 appliances are facing significant security challenges, with attackers actively exploiting five zero-day vulnerabilities since late 2025. These vulnerabilities have put SonicWall customers at risk, as they have been under attack for years. The ongoing exploitation means that organizations using these devices need to be particularly vigilant about their security posture. This situation raises concerns about the reliability of SonicWall products and highlights the importance of prompt patching and updates to mitigate such risks. As attackers continue to target these vulnerabilities, it is crucial for affected users to stay informed and take necessary precautions.

Sep 3, 2026

Coder's registry infrastructure compromised to push malicious modules

BleepingComputer

Attackers have breached Coder's Cloudflare infrastructure, enabling them to insert unauthorized registry servers. These servers distributed malicious Terraform modules that contained code designed to steal user credentials. This incident poses a significant risk to developers and organizations that rely on Terraform for infrastructure management, as they could unknowingly use compromised modules, leading to potential data theft and security breaches. Users of Coder's services need to be vigilant, as the malicious code could affect their systems and expose sensitive information. The incident underscores the necessity for robust security measures when integrating third-party modules into development workflows.

Sep 3, 2026

HPE patches critical ArubaOS-CX remote code execution flaw

BleepingComputer

Hewlett Packard Enterprise (HPE) has addressed a serious security vulnerability in its ArubaOS-CX network operating system. This flaw could allow attackers to execute remote code, potentially compromising affected systems. Organizations using ArubaOS-CX are at risk, as this vulnerability could lead to unauthorized access and manipulation of network functions. HPE has released patches to fix the issue, and it's crucial for users to update their systems promptly to prevent exploitation. Cybersecurity experts recommend that companies prioritize applying these updates to safeguard their networks from potential attacks.

Sep 3, 2026

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

The Hacker News

In this latest update on cybersecurity threats, attackers are increasingly using tactics that exploit user trust and familiarity. Phishing kits targeting CEOs are on the rise, alongside hacks affecting around 5,000 Dropbox accounts. These attacks often appear legitimate, with users receiving calls from IT, sharing files, or being prompted to click 'Allow' on trusted apps. Additionally, attackers are employing fake login pages and old account links to trick users into giving up their credentials. This highlights the need for heightened awareness and caution when interacting with seemingly innocuous requests, as one small mistake can lead to significant breaches.

Sep 3, 2026

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

The Hacker News

Cisco has issued critical patches for a vulnerability in its Nexus 9000 series switches, specifically those based on Silicon One architecture. This flaw, identified as CVE-2026-20212, carries a CVSS score of 9.8, indicating a severe risk. It allows remote attackers, without needing to authenticate, to execute code with root privileges on impacted systems. Alongside this vulnerability, Cisco also released a hardening update for IOS XR that includes seven additional CVEs, two of which are also rated very high at 9.8. Users of these Nexus switches should prioritize applying the patches as there are currently no workarounds available for the IOS XR versions affected.

Sep 3, 2026

Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal

SecurityWeek

The Manchester Airports Group (MAG) has suffered a significant data breach, with hackers leaking around 550GB of sensitive information related to 8.8 million individuals. This incident occurred after MAG reportedly declined to meet the ransom demand from the attacking group. The hackers claimed they accessed the data through exposed administrative keys, raising concerns about the security measures in place at the airport group. This breach not only compromises the personal information of millions but also highlights the ongoing risks organizations face from ransomware attacks and the importance of securing sensitive data. As the fallout from this incident unfolds, it serves as a reminder for companies to reinforce their cybersecurity practices and be vigilant against potential vulnerabilities.

Sep 3, 2026