Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

Australian IT security professionals are being warned of a new financially motivated threat actor identified by CrowdStrike as “Slim Spider”. The group has been linked to a series of attacks on Brazilian financial institutions that began in March 2026, targeting the custodial secrets of cryptocurrency holdings.

CrowdStrike’s analysis indicates that Slim Spider possesses deep operational knowledge of Brazil’s financial infrastructure, including the country’s instant‑payment system, enabling the group to infiltrate networks and exfiltrate sensitive crypto‑custody data without detection.

While the incidents have so far been confined to Brazil, the tactics demonstrated by Slim Spider – sophisticated credential harvesting, lateral movement, and data exfiltration – are relevant to Australian banks and fintech firms that rely on similar payment platforms and crypto services.

The revelations underscore the importance of robust security training for IT staff. Australian organisations are urged to review their incident‑response plans, enforce multi‑factor authentication, and ensure continuous monitoring of privileged accounts to mitigate the risk of similar intrusions.

For professionals seeking to strengthen their defensive capabilities, Wepro Technology in Darwin offers Security+ and other cybersecurity courses that cover threat‑intel analysis and best practices for protecting financial data in a cloud‑first environment.