LIGHTPAINT
- Malware type
- backdoor
- Family
- Malware family
- Operating systems
- windows
- Languages
- java
- Profile updated
- 2026-09-08 06:52:28
Targeted industries: financial-services retail-and-hospitality
Targeted regions: country_code:br
Context
LIGHTPAINT is a custom Java backdoor used by BREEZE COMET (also tracked as PLUMP SPIDER) against Brazilian financial organisations. Rather than build its own channel, it installs a legitimate VPN product such as SoftEther and configures it for automatic persistence. The operators then add inbound Windows Defender Firewall rules for the VPN manager and clear the associated VPN plugin event logs to remove traces of the connection.
Used by threat actors
- BREEZE COMET (threat-actor)