Slim Spider lifted crypto custody keys out of a Brazilian bank's cloud secret manager

A Bash script that queries the cloud instance metadata service and pushes temporary credentials back out over a socket connection leaves nothing on disk to hash ^[4]. That is the pivot point of this intrusion: the theft happens before anything recognizable as malware runs.

CrowdStrike names five components in the chain: Bash, sed, OpenSSL, Foundry's cast and Azure DevOps pipelines, all either shipped with the operating system or legitimate developer tooling ^[17]. Beyond those there are two named malware families: MikeDor, a Go backdoor that harvests data and watches user activity ^[14], and the implants pushed across the managed Kubernetes cluster ^[9]. In CrowdStrike's ordering of the attack, both arrive after the custody secrets are already gone ^[18]. A signature that fires on the implants fires on persistence, not on the theft.

CrowdStrike reads the OpenSSL choice as deliberate operational security: the actor signed inside its own Bash scripts rather than importing third-party libraries that would have introduced detection risk ^[7]. The events left behind are at the API layer. A metadata service read from a process with no reason to make one, followed by an enumeration that touches every entry in the credential store ^[5], is the whole theft. The Azure DevOps leg has the same shape one level up, a pipeline run deploying implants with credentials CrowdStrike assesses were compromised ^[9].

The panels say what the operation is built for. NEXUS // Scanner runs Ollama over discovered API endpoints and sorts them into 16 categories including fintech, banking, payment and cryptocurrency, ranked by availability and authentication options ^[10]. Painel de Emails Entra ID searches compromised Microsoft 365 mailboxes bucketed as finance, admin and Brazil ^[11]. Painel Pix pushes bulk unauthorized Pix transfers out of compromised accounts ^[12]. CrowdStrike also found an exposed command-and-control panel listing compromised hosts at several Brazil-based banks and fintechs, which it says likely exfiltrated archive files ^[13].

On the limits: CrowdStrike does not name the institution, does not give an initial access vector, and does not report a loss amount ^[19]. Its line about devastating financial loss describes what custody credentials allow, not a number from this victim ^[15].

A second crew is working the same rails. Google Threat Intelligence Group and Mandiant describe Breeze Comet, also tracked as CL-CRI-1163, Plump Spider and SHADOW-AETHER-064, breaking into the systems Brazilian financial organizations use to perform transactions and initiating payments for itself ^[16]. Neither vendor links it to Slim Spider. The overlap sits in the target list: two vendors documenting two separate crews going after the same country's payment infrastructure in the same window ^[21]. CrowdStrike's own framing is that e-crime actors are deliberately going after the credentials sitting closest to high-value financial assets ^[20]. In a bank that holds crypto, that is the secret manager, and its read pattern is the one control point ahead of the keys.