The Pix Gateway Heist by PLUMP SPIDER

Summarize this article with AI:

Ask ChatGPTAsk GrokAsk PerplexityAsk ClaudeAsk Google AI

The Story: The Compliant Heist

Act I: Fooling the Human — Getting Through the Front Door

Maya is an overworked IT administrator at a Brazilian bank. PLUMP SPIDER arrives posing as a technician from one of the bank’s trusted IT support vendors and says he is there to fix an urgent system issue. He looks legitimate and carries a USB drive that appears to contain the required security update. Trusting what seems like a routine support visit, Maya lets him into the staff area to carry out the work.

Act II: Fooling Security — Reaching the Crown Jewels

Getting inside the bank is only the beginning. The payment room is much deeper inside, protected by restricted doors and security checkpoints. PLUMP SPIDER searches for employee badges, keys, and authorization codes belonging to people with greater access. Each badge, key, or code gets him through another restricted door. Eventually, he has what he needs to enter the payment room as if he were an authorized employee.

Act III: Fooling the Machine — Abusing the Approval Process

Inside the payment room, PLUMP SPIDER prepares fraudulent payment orders and submits them through the bank’s real approval process. The machine sees what appears to be an authorized request and applies the bank’s genuine stamp. The orders are fake. The stamp is real. Once approved, the fraudulent orders are released into the same express payment system used for legitimate transfers.

Act IV: The Aftermath — The Heist Is Complete

The payment system sees properly approved orders and does exactly what it was designed to do: move the money quickly. By the time the bank realizes the instructions were fraudulent, the money has already moved and PLUMP SPIDER is gone. He never had to break the bank’s payment machinery. He tricked the bank into using its own trusted processes to complete the robbery.

Note: This comic is a simplified, fictionalized analogy inspired by publicly reported PLUMP SPIDER activity targeting Brazilian financial institutions and Pix-related payment infrastructure. Elements such as the USB drive, payment room, badges, and approval stamp are narrative devices and should not be interpreted as literal observed tactics. Confirmed technical findings are presented separately below.

PLUMP SPIDER Threat Overview: Brazil-Focused Financial Attacks

PLUMP SPIDER is a financially motivated threat actor known for targeting Brazil’s financial sector. Active since at least September 2023, the group has primarily targeted Brazilian banks, fintechs, payment service providers, and organizations connected to financial infrastructure.

Its use of native Brazilian Portuguese speakers and familiarity with local banking and support practices enable highly targeted social engineering against employees and other personnel with access to IT, identity, remote-support, or payment systems.

Its primary objective is financial fraud rather than ransomware. Credential and sensitive-data theft may be used as enabling steps, but the ultimate goal is to turn trusted access into payment authority.

PLUMP SPIDER Technical Attack Chain: From Initial Access to Pix Gateway Abuse

The attack chain typically begins with IT-support impersonation, using voice calls or messaging to pose as legitimate support personnel. Victims may be persuaded to install remote-management tools or execute attacker-supplied code, giving PLUMP SPIDER an initial foothold.

From there, the group works to move deeper into the environment while blending with trusted traffic. It uses legitimate remote-management software and encrypted VPN tunnels to make malicious communications resemble normal internal VPN activity. At the same time, communications with compromised .gov.br infrastructure can make external traffic appear to be reaching a trusted government entity. Together, these techniques can help evade firewall controls that rely on both traffic characteristics and destination reputation to identify suspicious activity.

Once inside, PLUMP SPIDER conducts network discovery and privilege escalation to expand access. A disguised PowerShell reconnaissance script associated with the activity maps the victim’s host, network, identity, and domain environment, then packages and transmits the collected data to attacker-controlled C2 infrastructure. This reconnaissance helps expose privileged accounts, credentials, certificates, API keys, and other authentication material that can provide access to core financial applications and payment systems.

The ultimate target is the bank’s Pix Gateway — the system used to send payments into Pix, Brazil’s instant-payment network. Once compromised, the gateway can be abused to create fraudulent pacs.008 payment instructions that appear to originate from the bank.

These payment instructions require a digital signature generated with the bank’s private signing key, which is protected inside a Hardware Security Module (HSM). Because the Pix Gateway is authorized to request those signatures, attackers controlling the gateway can feed fraudulent instructions into the legitimate signing process and obtain genuine bank signatures on fraudulent payments.

No signing key needs to be stolen and no cryptography needs to be broken. The attacker instead abuses the trusted relationship between the Pix Gateway and the HSM, turning fraudulent instructions into technically valid, bank-signed payments that can be submitted through Pix for real-time settlement.

Sangfor FarSight Labs Investigation: The aut-bank[.]com Surface

The public tradecraft above provides context for the actor. The FarSight Labs analysis below documents infrastructure and samples observed in this investigation; directly observed relationships are stated as findings, while actor-level links should be read alongside the external reporting in the Source Index.

Sample Communications Place the Domain in the Payload Chain

aut-bank[.]com (registered Sep 29, 2025) is assessed as malicious in this investigation, functioning as payload-delivery and C2-related infrastructure. ok.bat uses certutil to download JavaUpdate.jar and creates a SYSTEM startup task, while the JAR process handles victim registration/heartbeat and data exfiltration via multipart POST. Associated with multiple IPs (151.243.219[.]89, 24.152.36[.]138, 15.197.148[.]33, 3.33.130[.]190), the domain shows infrastructure migration and churn over time.

Defenders should correlate the domain, IPs, processes, and artifacts on a unified timeline to track infrastructure changes.

Brazilian Targeting Is Visible in the Infrastructure

The related names are not a random collection. solucaosuporte, painel-representantes, serprobr, plataforma10x, and enem10x draw on Portuguese-language support, representative-portal, service-platform, and Brazilian public-service or education themes. Other domains use randomized names such as raynfff, anryr, and kkujkqe. Combined with hosting nodes in São Paulo and Belo Horizonte, the naming and deployment pattern reflects preparation for Brazilian users and institutional environments.

Two Operational Infrastructure Sets

The first set centers on aut-bank[.]com and 151.243.219[.]89 and connects jyyyr[.]com, painel-representantes[.]com, serprobr[.]com, resumo.painelvinyjunior[.]com, and t2.painelvinyjunior[.]com. Portuguese-language support, representative-portal, and public-service themes give this cluster a clear Brazilian social-engineering and lure context. Together with confirmed payload download and data return, the relationships place aut-bank[.]com inside the same malicious delivery and social-engineering infrastructure cluster. Preserved evidence does not include a bank-login HTML page or screenshot on this domain, nor username, password, or OTP submissions, so a specific fake-bank portal on aut-bank[.]com is not claimed as fact.

The second set centers on 24.152.36[.]138 and connects plataforma10x[.]com[.]br, enem10x[.]com[.]br, raynfff[.]com, anryr[.]com, and kkujkqe[.]com with clouds.zip archives, Python-packaged executables, and a SoftEther-related archive. Related samples query their public egress address and then reach nuvem[.]host or rickcooder[.]nuvem[.]host, producing a useful environment-check-to-follow-on-connection sequence.

Key Relationship Chains

What the IOC Details Reveal About the Multi-Stage Payload Chain

ok.bat → JavaUpdate.jar → Registration and Data Return

The entry file ok.bat has SHA-256
f8339e5fbaee413b8154d83e313e4e4edb499c9c09de618353e20e7685166924.

At approximately 3 KB, it carries long-sleep and debugger-environment detection tags. Recorded commands show it using certutil to download http[:]//aut-bank[.]com/JavaUpdate.jar and creating a SYSTEM startup scheduled task for persistence. The evidence confirms that the JAR came from the domain; it does not show that ok.bat itself was delivered there.

The downloaded JAR has SHA-256
cfefa3ed12710aa5680ac739373a17a4637f1cd4bb06a8f1036ff9e5eff67106.

Its process chain builds the m parameter from hostname and timestamp, calls the /?m= endpoint, and uploads a local temporary text file using multipart POST. The GET pattern supports victim registration or heartbeat, while the POST supports reconnaissance-data exfiltration. Together they confirm a node serving both payload distribution and C2-related functions.

clouds.zip → Python-Packaged Executables

The two clouds.zip variants have SHA-256 19e13866627f3cd1b4cd0f9aac4945dd79605860f69c4396b70d8941fcaa986e and 84ad73535fd49de3ba36a2ceb4c865a8769749963cd327956e89cb4af95eba36.

Both are roughly 12 MB, contain PE files, and display long sleeps, user-input checks, or debugger-environment detection associated with sandbox evasion.

The first branch bundles qvmsrb.exe, SHA-256
be0ebf760d550af033fe5a1da3c081262bd2e78f9b1f0e5778ccbf030a553dc3.

The second branch is associated with a0b6ioc2.exe, SHA-256
d2e5d7669524473686efd5efbdcdd84463b7328ace122951fc76ab4c52cd2298.

Both executables are approximately 12 MB, drop runtime components typical of Python packaging, and overlap across TLSH, SSDEEP, and IMPHASH, supporting multi-version tracking as one build family.

Remote Channel and Disguised Archive Components

vpn.zip has SHA-256
bd55b1bc446855f1508e8a243f84163e12eed10ab01caa45c3f919b5863f8de4.

The archive contains PE files, carries persistence, long-sleep, and debugger-environment detection tags, and shows SoftEther VPN-related characteristics consistent with PLUMP SPIDER’s reported use of covert remote channels.

13Ex_zn.tar has SHA-256
16e61ac280757714bd4ada0fa0078bd8053c22db1f8034c157621f8b7b4cff48.

Despite its .tar extension, the file is a protected Win32 executable. The disagreement between archive-like naming and the actual PE type is a direct, high-value detection feature for mail gateways, download inspection, and endpoint controls.

Attack Chain and MITRE ATT&CK Mapping

Recommended Actions

1. Preserve evidence before removing access: Isolate suspicious endpoints and maintenance sessions while retaining script, process, network, identity, and payment records.
2. Rotate the full reachable credential set from clean systems: Include employee, supplier, remote-access, service-account, gateway-management, and signing identities.
3. Make IT support independently verifiable: Require every update and remote-assistance request to map to a searchable ticket and a known callback path.
4. Constrain scripts and remote access: Apply allowlists, time-bound approval, change windows, and least privilege to interpreters, remote services, tunnels, and relays.
5. Segment payment gateways from office and support networks: Deny default reachability and revalidate identity and device posture at every hop.
6. Bind signing to transaction context: Use separation of duties, dual control, velocity and amount limits, and traceability from every HSM call to the original order and approval.
7. Track infrastructure change continuously: Monitor time-bounded DNS, certificates, similar samples, and randomized domains using multi-evidence scoring rather than broad cloud or ASN blocks.

How Sangfor Helps

Call to Action

Sangfor Farsight Labs is dedicated to tracking and analyzing global advanced threat landscapes. By leveraging its robust automated attribution and external monitoring systems, the lab delivers rapid, precise analysis and cross-correlation of APT attack samples. Having archived comprehensive profiles on dozens of APT and cybercrime entities, Farsight Labs has a proven track record of helping clients successfully mitigate high-stakes APT and cybercriminal incidents through expert incident response. In an era of escalating security conflicts and evolving TTPs, Sangfor’s Advanced Threat Team is committed to continuous vigilance and the rigorous research of new global security threats to ensure proactive defense.