Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
Palo Alto Networks Unit 42 tracks two ongoing intrusion clusters, CL-CRI-1131 (Mexican transportation, federal ministries, municipal water utilities) and CL-CRI-1163 (Brazilian financial sector), both using living-off-the-land techniques, SOCKS5 relays, and custom RATs. The attackers appear to orchestrate operations via commercial LLMs like Claude and GPT-4.1, evidenced by iterative batch scripts and AI-generated tunneling tool naming. The Mexican campaign (also reported as Operation Escaneo by CloudSEK) exfiltrated sensitive data via dynamic-DNS infrastructure with rotated multi-SAN TLS certificates between February and June 2026. This signals broader adoption of AI-enhanced operations by diverse threat groups in the region.
- Two clusters: CL-CRI-1131 (Mexico) and CL-CRI-1163 (Brazil) share SOCKS5 relay infrastructure
- Attackers used iterative batch scripts consistent with LLM-assisted trial and error
- Rotating multi-SAN certificates exposed target profiles (geolocation, intel, vaccines subdomains)
- Custom Go-based SOCKS5 proxy with iterative filenames suggests AI-assisted development
- Products
- NextChat
- Threat actors
- CL-CRI-1131CL-CRI-1163
- Organizations
- Palo Alto NetworksCloudSEKGambit
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | duckdns.org | Let's Encrypt TLS certificate using the domain m-doxa-apodo.duckdns[.]org and following a unique dynamic DNS naming standard. Share |
| ipv4 | 165.22.184.26 | 2ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 1 165.22.184[.]26 April 20, 2026 4e218e70afdbb116209ec0ebe8fc556e296e69648a |
| ipv4 | 167.148.195.53 | esearchers previously identified this SockTz proxy tool and 167.148.195[.]53 tied to persistent targeting of vulnerable JBoss servers. |
| ipv4 | 178.128.87.160 | 0afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 5 178.128.87[.]160 June 19, 2026 46ac289ce0c13666de616446f5d5a68da8bd150f4f0 |
| ipv4 | 62.171.185.97 | tackers troubleshooting connectivity with infrastructure at 62.171.185[.]97 . Infrastructure Analysis: Tracing Exfiltration Commands |
| sha256 | 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c | 648aa4e0425b83c0e863a8fee5 5 178.128.87[.]160 June 19, 2026 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c 5 178.128.87[.]160 Table 2. Certificate procurement timelin |
| sha256 | 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 | 23187010c4d38dbf88fcb40bf8 1 165.22.184[.]26 April 20, 2026 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 5 178.128.87[.]160 June 19, 2026 46ac289ce0c13666de616446f5 |
| sha256 | 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 | ture. Date Certificate SHA-256 Hash SANs Host Feb. 27, 2026 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 1 165.22.184[.]26 April 20, 2026 4e218e70afdbb116209ec0ebe8 |
| sha256 | 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec | cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec URL: hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe Additiona |
| sha256 | a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 | 65.22.184[.]26 Brazilian Financial Campaign SHA-256 hashes: a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee |
| url | http://167.148.195.53:8888/socktz_v9.exe | a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec URL: hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe Additional Resources Operation Escaneo — CloudSEK Vibe |
From the original article
8 min read at unit42.paloaltonetworks.com
Explore how attackers targeting Latin American entities use AI for data exfiltration and how basic OpSec errors allow defenders to disrupt operations. The post Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America appeared first on Unit 42.
By Reese Lewis and Sara McBroom · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.