42
57
42
57
42
42
42
57
42
42
57
57
42
42
42
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
Palo Alto Networks Unit 42 tracks two ongoing intrusion clusters, CL-CRI-1131 (Mexican transportation, federal ministries, municipal water utilities) and CL-CRI-1163 (Brazilian financial sector), both using living-off-the-land techniques, SOCKS5 relays, and custom RATs. The attackers appear to orchestrate operations via commercial LLMs like Claude and GPT-4.1, evidenced by iterative batch scripts and AI-generated tunneling tool naming. The Mexican campaign (also reported as Operation Escaneo by CloudSEK) exfiltrated sensitive data via dynamic-DNS infrastructure with rotated multi-SAN TLS certificates between February and June 2026. This signals broader adoption of AI-enhanced operations by diverse threat groups in the region.
72
57
42
42
42
57
57
42
42
42
42
57
42
57
42
42
42
57
57
42
Fwd: Tor Project Forum: Security Release 0.4.9.12
Tor released 0.4.9.12 with several high-severity fixes, some found via LLMs, plus recommended protocol updates and removal of TAP key acceptance.
The Tor Project shipped version 0.4.9.12, a security release containing several high-severity fixes, some reportedly discovered with the help of LLMs. The release recommends new protocol versions (41316) for both clients and relays. Directory authorities will no longer accept relay descriptors containing TAP keys.
35
60
47
42
42