Slim Spider March 2026 intrusion exfiltrated Brazilian bank crypto custody keys via cloud metadata scripts and OpenSSL signing

CrowdStrike documented the actor deploying MikeDor, a Go backdoor, and the "spi" implant impersonating Brazil's Pix payment system on Kubernetes nodes. The group enumerated secrets via sed-modified scripts, invoked Foundry's cast tool to derive Ethereum addresses from stolen keys, and ran malicious pipelines from compromised Azure DevOps credentials. An exposed C2 panel listed hosts from multiple Brazilian banks and fintechs with exfiltrated archives. Technical traces show deliberate avoidance of third-party libraries through direct OpenSSL cryptographic signing inside Bash and cloud-native metadata queries over sockets. This matches patterns in prior e-crime operations against financial custody but adds Brazil-specific Pix automation panels and Ollama-driven endpoint categorization. No independent technical attribution beyond CrowdStrike's telemetry has confirmed state involvement. The operation reveals recurring targeting of high-value digital asset credentials over generic banking access. Similar clusters have shifted from initial access brokers to direct wallet control within 60 days of cloud foothold. Next indicators will likely appear in Azure activity logs showing anomalous pipeline executions or new NEXUS scanner hits on fintech endpoints. Defenders should prioritize monitoring of cloud credential managers tied to crypto wallets and enforce strict separation between DevOps pipelines and production clusters.