JADEPUFFER: the first agentic ransomware
External Attack Surface Management: reducing your external exposure
Stay ahead of threats to your industry with real-time intelligence.
Your executives are targets. Monitor your leadership's digital exposure.
Lab Research
5 min read
Slim Spider: the possibly Brazilian group that attacks the banking cloud to reach Pix and crypto-asset custody
safe-e Intelligence Team
Cyber Threat Intelligence
A Brazilian eCrime threat actor that, instead of defrauding customers, breaks into the cloud, CI/CD and custody infrastructure of banks and fintechs to reach Pix and crypto assets.
Slim Spider is an eCrime threat actor most likely made up of Brazilian operators, according to a high-confidence assessment by CrowdStrike. Active since at least March 2026, the group targets the cloud environments of Brazilian banks, fintechs, financial consultancies and betting companies, with a focus on Pix and crypto asset custody. Instead of defrauding customers, it attacks the cloud, CI/CD and custody infrastructure that underpins financial operations.
Who Slim Spider is
CrowdStrike backs the Brazil attribution with three pieces of evidence: the group exclusively targets Brazilian financial entities, whose operations it knows in depth; the MikeDor implant contains PDB paths with the Portuguese word “Trabalho”; and the actor's web panels are written in Portuguese.
The goal is financial gain. The group most likely monetizes its intrusions through payment fraud across several platforms, including Pix, and has also been observed exfiltrating digital asset data. CrowdStrike found an exposed C2 panel listing compromised hosts from several Brazilian banks and fintechs. The number of victims has not been disclosed.
The March 2026 intrusion, phase by phase
In late March 2026, Slim Spider breached the cloud environment of a Brazilian financial institution with crypto asset custody and instant payment accounts. The confirmed outcome was the exfiltration of custody secrets and persistence in a container and Kubernetes cluster. Financial losses have not been disclosed.
Phase | What the group did |
|---|---|
1. Temporary credentials | Custom Bash scripts query the instance metadata over socket connections |
2. Secrets enumeration | Lists every secret in the cloud credential manager |
3. Script adaptation | Uses sed to clone and modify extraction scripts, focusing on digital asset credentials |
4. Exfiltration and wallet | Exfiltrates custody secrets, derives the Ethereum address with cast (Foundry) and signs with OpenSSL |
5. Persistence | Installs backdoors that mimic infrastructure binaries on container cluster nodes |
6. Pivot to DevOps | Moves to Azure DevOps and runs malicious pipelines that deploy “spi”, which mimics the Instant Payment System, to Kubernetes |
Slim Spider intrusion chain
The initial access vector for this intrusion has not been disclosed. The group's overall profile points to the likely compromise of third-party Git and CI/CD pipelines.
MikeDor and the Portuguese-language panels
The group's main implant is MikeDor, a custom backdoor written in Go, with Linux and Windows variants. The Windows builds are signed with fraudulent code signing certificates, and the group deletes files after use to remove evidence. Of the 23 hashes published by CrowdStrike, 16 came out between June 19 and 23, 2026, which points to a wave of new builds or deployments.
The group also runs three web panels: NEXUS // Scanner, which sweeps API endpoints and uses Ollama to sort them into 16 categories; a reconnaissance panel for Microsoft 365 mailboxes via Entra ID; and a Pix Panel for unauthorized bulk transfers.
Why the disguise works
Slim Spider gives everything it installs an infrastructure name. “spi”, pushed to Kubernetes by a malicious Azure DevOps pipeline, mimics the Instant Payment System. The backdoors on container nodes mimic infrastructure binaries, and staging in /tmp/systemd/ mimics a legitimate system component. On the outside, the logic is the same: the C2 domains are all .com, registered through Cloudflare, with names that mimic security, finance and development services.
The consequence for defenders is direct: an inventory validated by name approves the implant. The comparison has to be made against approved images and workloads. The same reasoning applies to blocking: since all registration goes through Cloudflare, it must be done by domain, not by provider.
What is confirmed and what is still likely
Confirmed by CrowdStrike: in the March 2026 intrusion, the exfiltration of custody secrets and persistence in containers and Kubernetes.
Assessed with high confidence: the group's Brazilian origin.
Likely: initial access through third-party Git and CI/CD pipelines, and monetization through payment fraud, including Pix.
Not disclosed: the vector for this intrusion, the number of victims, the losses, the group's structure, how the assets are laundered and the suppliers affected.
All press coverage derives from a single source, CrowdStrike.
What to do now
Published indicators: block the indicators released by CrowdStrike and retrohunt the MikeDor hashes in EDR, with DNS and proxy monitoring.
Code supply chain: review third-party access to Git repositories and pipelines, rotate tokens and require approval for pipeline changes.
Cloud metadata: require the protected version of the service (for example, IMDSv2 on AWS) and restrict access from pods and processes.
Custody secrets: segregate them from regular credentials, with just-in-time access, alerts for bulk enumeration and non-exportable keys (HSM or MPC).
Azure DevOps and Kubernetes: treat CI/CD as a production surface, with minimal scope and RBAC, admission control and alerts for names that mimic infrastructure, such as spi.
Pix: limits and dual approval for bulk transfers, plus monitoring for anomalous volume.
Conclusion
Slim Spider marks a shift in Brazilian financial crime: the target is no longer the customer but the infrastructure that keeps the operation running. The published indicators enable immediate blocking and hunting, but hashes and domains change quickly. Defense has to combine IOCs with behavioral detection and with controls over identities, secrets and pipelines.
The full analysis on the safe-e-CTI platform
safe-e clients find the full technical analysis of Slim Spider in the Intelligence module, under Lab Research: the report with recommendations, the mapped TTPs and the IoCs for download in CSV, ready to export to SIEM, SOAR, firewall and EDR. Talk to our team.
References
CrowdStrike. Slim Spider Adversary Profile. 30/09/2026. https://www.crowdstrike.com/en-us/adversaries/slim-spider/
CrowdStrike Falcon Intelligence. Lista de indicadores de MikeDor e Slim Spider (50 IOCs), com os relatórios “Adversary Debut: SLIM SPIDER” e “Elite Intrusion Digest: 24 a 30 de abril de 2026”. 04/10/2026. Portal Falcon Intelligence.
The Hacker News (Ravie Lakshmanan). Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution. 08/09/2026. https://thehackernews.com/2026/09/slim-spider-steals-crypto-custody.html
Total Security. Slim Spider rouba segredos de custódia de criptomoedas de instituição financeira brasileira. 09/09/2026. https://totalsecurity.com.br/noticia/slim-spider-rouba-segredos-de-custodia-de-criptomoedas-de-instituicao-financeira-brasileira
CyberStack. Slim Spider: Brazil e-crime cluster steals crypto custody secrets and Pix-linked cloud creds. 08/09/2026. https://cyberstack.org/n/slim-spider-brazil-20260908
SempreUpdate. Slim Spider: Ataque hacker mira nuvem e Pix no Brasil. 08/09/2026. https://sempreupdate.com.br/slim-spider-ataque-nuvem-pix-criptomoedas/
The Daily Tech Feed. Slim Spider Infiltrates Brazilian Crypto Custody Systems. 08/09/2026. https://thedailytechfeed.com/slim-spider-infiltrates-brazilian-crypto-custody-systems/
