Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks
Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.
74
Threat actor
CL-CRI-1131
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 3, 2026
- Last mentionedSep 10, 2026
Timeline
3 articles · newest firstHackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America
Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.
58
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
72
Appears with
- GPT-4.1ai model · 3
- Palo Alto Networksvendor · 3
- CL-CRI-1163threat actor · 3
- NextChatproduct · 3
- Claudeai model · 3
- SockTzproduct · 2
- Unit 42vendor · 2
- SHADOW-AETHER-040threat actor · 1
- SHADOW-AETHER-064threat actor · 1
- Trend Microvendor · 1
- Gambitvendor · 1
- CloudSEKorganization · 1
- CloudSEKvendor · 1
- GhostSocksmalware · 1
- Unit 42organization · 1
- Palo Alto Networksorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.