COBALTSPIN
- Family
- Malware family
- Languages
- rust
- Profile updated
- 2026-09-08 06:52:26
Targeted industries: financial-services retail-and-hospitality
Targeted regions: country_code:br
Context
COBALTSPIN is a lightweight network tunneler written in Rust and used by the eCrime group BREEZE COMET (also tracked as PLUMP SPIDER) against Brazilian financial organisations. It opens a reverse SOCKS5 proxy over a WebSocket connection so the operators can route traffic between their command and control and hosts inside segmented networks, reaching financial API infrastructure through boundary firewalls. It deliberately carries no persistence of its own, which keeps its footprint small.
Used by threat actors
- BREEZE COMET (threat-actor)