- Published on
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
- Authors
- Name
- DeepHorus
CrowdStrike has identified a new financially motivated threat actor, Slim Spider, targeting Brazilian financial institutions since March 2026. The group orchestrated a multi-stage intrusion at a Brazil-based financial institution in late March 2026, aiming at cryptocurrency assets and instant payment accounts. The findings were released on Sep 08, 2026.
Slim Spider shows deep knowledge of Brazilian financial infrastructure, including Pix, digital asset platforms, and cloud environments. It used custom Bash scripts to query cloud instance metadata and steal temporary cloud credentials over socket connections. It then enumerated secrets in the cloud credential manager and used sed to clone and modify secret-extracting scripts.
The attack focused on credentials tied to digital financial assets. After exfiltrating custody secrets, Slim Spider used cast from the Foundry Ethereum toolkit to derive an Ethereum wallet address from a stolen private key. It also used OpenSSL directly in Bash scripts for cloud-native cryptographic signing, avoiding third-party libraries to reduce detection risk.
Slim Spider accessed nodes in a cloud container cluster and deployed backdoors mimicking infrastructure binaries. It pivoted to Azure DevOps, likely with compromised credentials, to run malicious pipelines across a managed Kubernetes cluster. One implant, named "spi," impersonated Sistema de Pagamentos Instantâneos, the infrastructure behind Pix.
CrowdStrike linked Slim Spider to web-based panels, including NEXUS // Scanner, which uses Ollama to categorize endpoints into 16 categories. Other tools include Painel de Emails Entra ID for searching compromised Microsoft 365 mailboxes and Painel Pix for bulk unauthorized Pix transfers. The actor also had an exposed command-and-control panel.
The discovery underscores the risk to financial institutions from criminals with specialized knowledge of local payment systems and cloud environments. Slim Spider's sophisticated evasion tactics could lead to significant financial losses. Organizations should strengthen cloud credential management and monitor for unusual Azure DevOps and Kubernetes activity.
