Cybersecurity researchers have identified a sophisticated criminal group operating within Brazil that specifically targets the cloud infrastructure of financial institutions. The group, designated SLIM SPIDER by CrowdStrike, represents a significant shift in how eCrime adversaries approach banking systems, moving away from direct attacks on public-facing services toward exploiting internal cloud environments.
The investigation began following an intrusion into a major Brazilian financial institution in March 2026. During this incident, researchers discovered that the attackers had successfully extracted temporary credentials from cloud metadata services, which allowed them to access digital vaults containing sensitive information. Among the stolen items were at least six confidential records related to digital financial assets, including cryptocurrency custody credentials and private wallet keys.
What distinguishes SLIM SPIDER from traditional cybercriminal groups is their reliance on legitimate identities rather than brute-force methods. According to Marcos Ferreira, vice president of sales engineering for Latin America at CrowdStrike, the group operates with valid credentials inside trusted environments where conventional security measures often fail to detect intrusions. This approach allows them to move laterally through compromised systems without triggering standard alarms.
Researchers identified three distinct control panels developed by the group to manage different stages of their operations. One panel was designed to map banking and payment services for potential compromise, while another focused on searching compromised corporate email accounts for valuable information. The third tool, which drew particular attention, was built to automate unauthorized Pix transfers from compromised accounts. Although the tool was functional and accepted all types of Pix keys, investigators could not confirm whether any fraudulent transactions were actually executed.
The group also deployed custom malware, including a backdoor named MikeDor written in Go programming language and an implant called spi that mimics components of the Sistema de Pagamentos Instantâneos, the central infrastructure processing Pix payments. Despite these names, experts emphasize that the attacks targeted individual institution systems rather than the Pix network itself or the Central Bank of Brazil.
This case aligns with broader trends documented in CrowdStrike's 2026 Threat Hunting Report, which recorded a 171 percent increase in criminal activity directed at cloud environments between July 2025 and June 2026. The report indicates that organizations are adopting cloud services faster than they can implement adequate cybersecurity investments, creating opportunities for threat actors.
Financial institutions face several risks from such intrusions. Compromised development environments can allow attackers to install malicious software through legitimate application distribution processes. Access to credential managers enables theft of authentication tokens and API keys that provide entry to customer accounts and financial systems. Additionally, stolen cryptocurrency custody credentials pose direct threats to digital asset holdings.
However, CrowdStrike researchers note that the immediate risk may be more contained than initially feared. While the group demonstrated capability to execute mass transfers, there is no evidence confirming successful financial losses in the investigated incident. The primary danger lies in the exposure of sensitive operational data and the potential for future exploitation if vulnerabilities remain unaddressed.
Security experts recommend that banks and fintech companies limit access permissions in cloud environments, protect stored credentials rigorously, and monitor for suspicious activities. Regular reviews of service accounts and tracking changes in development systems involving sensitive information are essential defensive measures. Organizations should also implement unified visibility across identities, devices, cloud platforms, and development environments to detect lateral movement early.
The discovery of SLIM SPIDER highlights the evolving nature of financial cybercrime, where deep knowledge of local infrastructure combines with modern cloud exploitation techniques. As more Brazilian financial institutions migrate to cloud-based systems, maintaining robust security practices becomes increasingly critical to preventing similar incidents.