Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks
Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.
Palo Alto Networks Unit 42 identified two activity clusters, CL-CRI-1131 and CL-CRI-1163, tied by shared SOCKS5 relay infrastructure and use of large language models during operations. The Mexican cluster targeted a transportation organization, federal ministries and water utilities in Mexico and Ecuador, while the Brazilian cluster used resume-themed phishing, custom remote-access Trojans and SockTz SOCKS5 tunneling against financial organizations. An exposed self-hosted NextChat interface on attacker infrastructure led researchers to assess operators used Claude and GPT-4.1 to generate workaround scripts and troubleshoot execution failures. Unit 42 noted AI reduced time needed to troubleshoot intrusions after initial access, rather than replacing the attacker.
- Clusters CL-CRI-1131 and CL-CRI-1163 hit Mexico, Ecuador and Brazil victims including water utilities and finance.
- Exposed NextChat instance revealed use of Claude and GPT-4.1 for script generation and troubleshooting.
- Operators created volume shadow copies and iterated numbered batch scripts to collect Windows data.
- Brazilian cluster deployed versions 1-9 of SockTz within roughly two hours, suggesting model-assisted development.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1059.003 Windows Command ShellT1005 Data from Local SystemT1105 Ingress Tool TransferT1572 Protocol Tunneling
- Vendors
- Palo Alto NetworksUnit 42
- Threat actors
- CL-CRI-1131CL-CRI-1163
- Malware
- GhostSocks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | duckdns.org | d for data exfiltration troubleshooting Domain m-doxa-apodo.duckdns[.]org Mexican campaign infrastructure domain Domain m-doxa-geo. |
| ipv4 | 165.22.184.26 | dns[.]org Mexican campaign infrastructure domain IP address 165.22.184[.]26 Host associated with campaign TLS certificate IP address |
| ipv4 | 167.148.195.53 | NextChat and campaign certificate infrastructure IP address 167.148.195[.]53 Open directory hosting SockTz installers and campaign scr |
| ipv4 | 178.128.87.160 | 26 Host associated with campaign TLS certificate IP address 178.128.87[.]160 Host linked to NextChat and campaign certificate infrastr |
| ipv4 | 62.171.185.97 | f Compromise (IoCs):- Type Indicator Description IP address 62.171.185[.]97 CL-CRI-1131 infrastructure used for data exfiltration tro |
| sha256 | 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c | rprint associated with 178.128.87[.]160 Certificate SHA-256 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c Certificate fingerprint associated with 178.128.87[.]160 Fi |
| sha256 | 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 | erprint associated with 165.22.184[.]26 Certificate SHA-256 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 Certificate fingerprint associated with 178.128.87[.]160 Ce |
| sha256 | 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 | SockTz installers and campaign scripts Certificate SHA-256 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 Certificate fingerprint associated with 165.22.184[.]26 Cer |
| sha256 | 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec | zilian financial campaign malware or tool hash File SHA-256 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec Brazilian financial campaign malware or tool hash URL hxxp[ |
| sha256 | a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 | e fingerprint associated with 178.128.87[.]160 File SHA-256 a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 Brazilian financial campaign malware or tool hash File SHA- |
| url | http://167.148.195.53:8888/socktz_v9.exe | 172ec Brazilian financial campaign malware or tool hash URL hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe Download location for SockTz version 9 File name socktz |
From the original article
4 min read at cybersecuritynews.com
Hackers have used commercial AI models to help break into government, transport and financial networks across Latin America. The activity shows how chat-based tools can speed up familiar intrusion work, from fixing faulty scripts to moving stolen information out of a compromised system. The campaigns did not rely on a new AI-built malware family alone.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.