Cybersecurity operations at CrowdStrike have uncovered a dedicated financial threat group designated Slim Spider, operating targeted intrusions against Brazilian commercial banks, fintech unicorns, and cryptocurrency asset custodians. The group exhibits intimate operational expertise in Latin American payment networks, specifically targeting the Central Bank of Brazil's instant payment system, Pix.

Unlike commodity banking trojan operators that rely on desktop overlays or retail user phish kits, Slim Spider conducts sophisticated server-side enterprise intrusions. Their operational tradecraft focuses on cloud-hosted payment microservices, container clusters, and digital asset custody architectures.

Intrusion Tradecraft: Cloud IMDS to Core Payment Settlement

CrowdStrike's threat telemetry indicates that Slim Spider initiates attacks through exposed web applications or stolen cloud administrative tokens. Once establishing an initial foothold inside a cloud container, the actors deploy custom Bash scripts designed to query the local cloud Instance Metadata Service (IMDS):

  • Credential Harvesting via Metadata: The adversary queries 169.254.169.254 to extract temporary IAM security credentials associated with cloud role assignments.
  • API Discovery and Settlement Reconnaissance: Using the stolen credentials, the actors enumerate internal cloud services, specifically searching for microservices communicating with Pix Direct Participant (Participante Direto) messaging gateways and HSM-backed digital signature modules.
  • Manipulation of Pix Transaction Limits: In multiple intrusions, Slim Spider attempted to tamper with internal configuration registries that enforce nocturnal transfer ceilings, attempting to facilitate high-value illicit fund movement into money-mule accounts before automated fraud detection algorithms triggered.

Strategic Defenses for Fintech & Web3 Operators

Domain Threat Vector Prescribed Control
Cloud Metadata SSRF extraction of IAM role keys via IMDSv1 Enforce IMDSv2 across all AWS instances; set HTTP hop limit to 1
Pix Payment Core Direct API invocation of settlement microservices Implement Mutual TLS (mTLS) with hardware-backed client certs
Crypto Custody API key theft targeting warm wallet withdrawal triggers Enforce multi-party computation (MPC) and multi-signature quorum rules