Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks

Hackers have used commercial AI models to help break into government, transport and financial networks across Latin America.

The activity shows how chat-based tools can speed up familiar intrusion work, from fixing faulty scripts to moving stolen information out of a compromised system.

The campaigns did not rely on a new AI-built malware family alone. One operation abused legitimate Windows utilities and repeated batch scripts, while another used job-themed phishing, remote-access malware and a proxy tool to reach targets in Brazil’s financial sector.

Unit 42 analysts identified the two clusters as CL-CRI-1131 and CL-CRI-1163, linking them through overlapping SOCKS5 relay infrastructure and a shared pattern of using large language models during operations.

The victims included a Mexican transportation organization, federal ministries, municipal water utilities in Mexico and Ecuador, and Brazilian financial organizations.

Palo Alto Networks’ Unit 42 said in a report shared with Cyber Security News (CSN) that the impact is significant because AI appears to have reduced the time needed to troubleshoot an attack after access was gained.

Rather than replacing the attacker, the models helped operators test fixes, refine scripts and keep a multi-stage intrusion moving when earlier commands failed.

Hackers Use Claude and GPT-Powered Tools

In the Mexican campaign, operators attempted to obtain sensitive Windows data, including account and directory information.

When those attempts failed, they created volume shadow copies and used numbered batch files to copy data, changing the scripts as they worked through permissions and collection problems.

The team found an exposed, self-hosted NextChat interface on the attackers’ infrastructure. NextChat can provide one place to work with multiple models, and the surrounding activity led researchers to assess that the operators used Claude and GPT-4.1 to generate workaround code and troubleshoot execution failures.

This is a more practical threat than the idea of AI independently carrying out a breach. AI can make an operator’s trial-and-error cycle faster, especially after an initial foothold is established.

Security teams facing AI-generated phishing without malware should examine what happens after a suspicious message is opened, not only whether a file was delivered.

The operational security failures can offer defenders a way to trace and disrupt campaigns. Publicly reachable AI and staging systems gave investigators visibility into scripts, prompt history and targeting clues.

Phishing Campaign Targets Finance

The Brazilian cluster began with a resume-themed phishing attachment and then deployed custom remote-access Trojans.

The operators also tried to install multiple versions of SockTz, a Go-based reverse SOCKS5 tunneling tool, using a compromised WordPress site before switching to infrastructure they controlled.

A SOCKS5 tunnel can relay traffic through a compromised machine, helping an attacker reach internal systems while masking where commands originate.

That makes it important to investigate unusual outbound connections and proxy behavior, as GhostSocks proxy malware activity has shown how such relays can undermine anti-fraud and location-based controls.

Researchers observed versions one through nine of SockTz within roughly two hours, plus scripts carrying descriptive names and an “_output” suffix.

The rapid, repetitive naming is consistent with automated or model-assisted development, though it does not prove that every file was produced by an AI system.

Organizations should promptly patch internet-facing web servers, block or restrict exposed administrative and staging directories, and review email attachments that claim to be resumes or job documents.

They should also hunt for unexpected web shells, remote-access tools and outbound proxy traffic, while using the listed indicators to search logs and block confirmed malicious connections.

The cases underline that AI does not erase the need for basic defense. Strong patching, email filtering, network monitoring and disciplined access controls remain essential, particularly as AI agents drive cyberattacks and attackers use them to organize routine tasks at greater speed.

For defenders, the practical lesson is to follow the infrastructure as closely as the malware. Exposed servers, reusable certificates and open directories can reveal an operation’s working methods, and Kimsuky AI phishing decoys similarly show why teams need visibility into convincing lures and follow-on activity.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
IP address	62.171.185[.]97	CL-CRI-1131 infrastructure used for data exfiltration troubleshooting
Domain	m-doxa-apodo.duckdns[.]org	Mexican campaign infrastructure domain
Domain	m-doxa-geo.duckdns[.]org	Mexican campaign infrastructure domain
Domain	m-doxa-intel.duckdns[.]org	Mexican campaign infrastructure domain
Domain	m-doxa-repuve.duckdns[.]org	Mexican campaign infrastructure domain
Domain	m-doxa-sre.duckdns[.]org	Mexican campaign infrastructure domain
Domain	m-doxa-vacunas.duckdns[.]org	Mexican campaign infrastructure domain
IP address	165.22.184[.]26	Host associated with campaign TLS certificate
IP address	178.128.87[.]160	Host linked to NextChat and campaign certificate infrastructure
IP address	167.148.195[.]53	Open directory hosting SockTz installers and campaign scripts
Certificate SHA-256	7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8	Certificate fingerprint associated with 165.22.184[.]26
Certificate SHA-256	4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5	Certificate fingerprint associated with 178.128.87[.]160
Certificate SHA-256	46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c	Certificate fingerprint associated with 178.128.87[.]160
File SHA-256	a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996	Brazilian financial campaign malware or tool hash
File SHA-256	87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec	Brazilian financial campaign malware or tool hash
URL	hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe	Download location for SockTz version 9
File name	socktz_v8.exe	SockTz version 8 installer observed in execution attempt
File name	socktz_v9	SockTz version 9 installer referenced by researchers
File name	exploit_creative.py	Script exposed in attacker-controlled open directory
File name	exploit_careful.py	Script exposed in attacker-controlled open directory
File name	rce_focused.py	Script exposed in attacker-controlled open directory

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.