Product

SockTz

2 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 10, 2026 · last 5d ago

Timeline2 articles

Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks

Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.

Palo Alto Networks Unit 42 identified two activity clusters, CL-CRI-1131 and CL-CRI-1163, tied by shared SOCKS5 relay infrastructure and use of large language models during operations. The Mexican cluster targeted a transportation organization, federal ministries and water utilities in Mexico and Ecuador, while the Brazilian cluster used resume-themed phishing, custom remote-access Trojans and SockTz SOCKS5 tunneling against financial organizations. An exposed self-hosted NextChat interface on attacker infrastructure led researchers to assess operators used Claude and GPT-4.1 to generate workaround scripts and troubleshoot execution failures. Unit 42 noted AI reduced time needed to troubleshoot intrusions after initial access, rather than replacing the attacker.

Cyber Security Newsupdated Sep 11, 07:24 UTC · 4d agofirst Sep 10, 08:06 UTC · 5d agoThreat actor in the wild 10 sources1

Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America

Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.

Unit 42 identified two campaigns in Latin America whose operators used commercial LLMs (Claude, GPT-4.1) behind a self-hosted NextChat interface to generate and debug post-exploitation scripts. Cluster CL-CRI-1131 compromised a transportation organization, Mexican federal ministries, and water utilities in Mexico and Ecuador, using native Windows tools and Volume Shadow Copies to dump the SAM registry hive and NTDS.dit. Cluster CL-CRI-1163 targeted Brazilian financial organizations with job-themed phishing, custom RATs, and a Go-based reverse SOCKS5 tunneling utility called SockTz, with nine versions deployed within roughly two hours. Trend Micro tracks related AI-augmented activity as SHADOW-AETHER-040 and SHADOW-AETHER-064.

GBHackersupdated Sep 11, 07:24 UTC · 4d agofirst Sep 10, 06:02 UTC · 5d agoThreat actor in the wild 10 sources1

Appears with

threat actor CL-CRI-1131 2 threat actor CL-CRI-1163 2 ai model Claude 2 ai model GPT-4.1 2 product NextChat 2 vendor Palo Alto Networks 2 vendor Unit 42 1 organization Unit 42 1 threat actor SHADOW-AETHER-040 1 threat actor SHADOW-AETHER-064 1 malware GhostSocks 1 vendor Trend Micro 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.