A newly documented cybercrime group is showing how financial attacks are moving beyond customer accounts and into the cloud infrastructure that controls institutional payments and cryptocurrency. Tracked as Slim Spider, the Brazil-based actor has demonstrated detailed knowledge of banking technology, the Pix instant-payment ecosystem and digital-asset custody operations.
Targeting credentials closest to the money
In an intrusion observed at a Brazilian financial institution, Slim Spider used custom Bash scripts to query cloud instance metadata and obtain temporary credentials. The attackers then searched the organization's cloud credential manager for secrets associated with valuable financial systems and digital assets.
After stealing cryptocurrency custody material, the group reportedly used an Ethereum development tool to determine the wallet address connected to a compromised private key. It also implemented cryptographic signing through OpenSSL inside its own scripts, reducing its reliance on external libraries that could create additional detection opportunities.
The operation extended into managed container infrastructure. Slim Spider established access to cloud container-service nodes, deployed backdoors with names resembling legitimate infrastructure components and pivoted into Azure DevOps. Compromised development credentials were apparently used to execute malicious pipelines that distributed implants across a Kubernetes cluster.
Cloud administration becomes a financial control
This campaign matters because it treats DevOps systems, cloud metadata services and secret managers as parts of the payment environment. An attacker who controls a deployment pipeline may be able to place code near transaction-processing services without attacking a traditional banking application directly.
In my view, financial institutions must stop treating cloud credentials as ordinary IT secrets. Credentials capable of reaching wallets, signing services or payment infrastructure should be protected as financial instruments, with strict separation of duties and continuous monitoring.
Reducing the attack surface
- Limit workload access to instance metadata and require hardened metadata-service configurations.
- Use short-lived, narrowly scoped identities instead of reusable cloud credentials.
- Prevent DevOps service accounts from directly retrieving production custody secrets.
- Require approval and cryptographic validation for production pipeline changes.
- Monitor secret-store enumeration, unusual pipeline execution and unexpected container deployments.
- Keep signing keys in hardware-backed systems that do not expose private material to workloads.
Slim Spider represents a shift from high-volume consumer fraud toward direct compromise of financial infrastructure. I believe this model will attract imitators because cloud systems can provide a quiet route to assets with immediate monetary value. Defenders should therefore map every technical identity and automation pipeline that can influence a transaction, not merely the applications visible to customers.