Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

What Happened

Attackers targeting organizations in Latin America are using artificial intelligence tools to help them break into systems and steal data. In two separate campaigns, one targeting Mexican transportation and government groups and another targeting Brazilian financial institutions, attackers used AI to write scripts and fix problems they encountered during the intrusions. The attackers made operational security mistakes, such as leaving their tool directories and AI interfaces exposed on the internet, which allowed security researchers to track their activities and intended targets. Organizations in the region should review their security posture, be on the lookout for phishing emails, and hunt for the specific tools and infrastructure used by these attackers.

Key Takeaways

• Attackers are using commercial LLMs like Claude and GPT-4.1 via self-hosted NextChat instances to generate scripts and troubleshoot operational failures during intrusions.
• Two distinct campaigns, CL-CRI-1131 and CL-CRI-1163, targeted Latin American organizations using living-off-the-land techniques and custom RATs respectively.
• Attackers deployed a Go-based reverse SOCKS5 tunneling tool named SockTz with iterative versioning (v1-v9) indicating AI-assisted development.
• Operational security failures by the attackers, such as exposed open directories and unsecured NextChat interfaces, allowed researchers to map their infrastructure and targets.
• Infrastructure overlaps include shared SOCKS5 relay infrastructure and multi-SAN TLS certificates revealing intended targets like Mexican federal government ministries.

Affected Systems

• Windows endpoints
• Domain controllers
• Web servers (JBoss)
• WordPress sites

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: CL-CRI-1163 used resume-themed phishing emails; CL-CRI-1131 initial access vector not explicitly detailed but involved host-based operations.
2. Execution & AI Integration: Attackers used self-hosted NextChat instances with commercial LLMs (Claude, GPT-4.1) to generate scripts and troubleshoot execution failures.
3. Credential Access: In CL-CRI-1131, attackers created volume shadow copies to dump the SAM registry hive and NTDS.dit file after repeated failed attempts.
4. Persistence & Defense Evasion: CL-CRI-1163 deployed multiple versions (v1-v9) of a Go-based reverse SOCKS5 tunneling tool named SockTz to establish proxy connections.
5. Exfiltration: CL-CRI-1131 exfiltrated data to 62.171.185.97 using the domain m-doxa-apodo.duckdns.org; CL-CRI-1163 staged scripts and tools on an open directory at 167.148.195.53.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No specific detection rules (YARA, Sigma, Snort/Suricata, KQL, SPL, EQL) are provided in the article. Palo Alto Networks products (Advanced WildFire, Cortex XDR, XSIAM, Advanced URL Filtering, Advanced DNS Security) are mentioned as providing protections.

Detection Engineering Assessment

Required Log Sources

• EDR process execution logs
• DNS logs
• Web proxy logs
• TLS certificate logs (for SAN matching)
• Firewall logs

Hunting Hypotheses

Control Gaps

• Standard signature-based AV may miss custom RATs and AI-generated scripts with unique filenames.
• DNS filtering may not block dynamic DNS domains if they are newly registered or not yet categorized as malicious.

Key Behavioral Indicators

• Execution of vssadmin.exe followed by copy commands accessing shadow copy paths
• Process execution of files with iterative version naming (e.g., socktz_v1.exe to socktz_v9.exe)
• Network connections to *.duckdns.org domains with 'm-doxa-' prefix
• Execution of Python scripts with descriptive adjectives in filenames (e.g., exploit_careful.py)
• Outbound connections to TCP port 3000 on known malicious IPs

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Evaluate restricting outbound traffic to dynamic DNS domains (*.duckdns.org) where not required for business operations.
• Consider implementing TLS inspection to detect multi-SAN certificates that may reveal attacker infrastructure targeting patterns.
• Review and restrict access to TCP port 3000 and other non-standard ports to prevent communication with unapproved NextChat instances.

User Protection

• Consider deploying email filtering rules to block resume-themed phishing attachments, particularly in Latin American regions or financial sector organizations.
• Ensure endpoint protection is updated with the latest signatures and behavioral detection capabilities for custom RATs and tunneling tools.

Security Awareness

• Consider incorporating warnings about resume-themed phishing emails into existing security awareness programs, especially for financial sector employees.
• Reinforce the importance of reporting suspicious emails and unexpected system behavior, as attackers are using AI to make their lures and scripts more convincing.

MITRE ATT&CK Mapping

Additional IOCs

• Ips:
  • 165[.]22[.]184[.]26 - Host associated with a single-SAN Let's Encrypt certificate used in February 2026 for the CL-CRI-1131 campaign.
• Domains:
  • m-doxa-geo[.]duckdns[.]org - Subdomain indicating geolocation operational function, revealed via multi-SAN certificate in CL-CRI-1131.
  • m-doxa-intel[.]duckdns[.]org - Subdomain indicating intelligence operational function, revealed via multi-SAN certificate in CL-CRI-1131.
  • m-doxa-repuve[.]duckdns[.]org - Subdomain indicating targeting of REPUVE (Mexican vehicle registry), revealed via multi-SAN certificate in CL-CRI-1131.
  • m-doxa-sre[.]duckdns[.]org - Subdomain indicating targeting of SRE (Mexican Secretary of Foreign Affairs), revealed via multi-SAN certificate in CL-CRI-1131.
  • m-doxa-vacunas[.]duckdns[.]org - Subdomain indicating targeting of vaccines (likely health ministry), revealed via multi-SAN certificate in CL-CRI-1131.
• File Hashes:
  • 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c (SHA256) - Let's Encrypt TLS certificate SHA-256 hash from June 19, 2026, associated with host 178.128.87.160 in CL-CRI-1131.
  • 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 (SHA256) - Let's Encrypt TLS certificate SHA-256 hash from April 20, 2026, associated with host 178.128.87.160 in CL-CRI-1131.
  • 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 (SHA256) - Let's Encrypt TLS certificate SHA-256 hash from Feb. 27, 2026, associated with host 165.22.184.26 in CL-CRI-1131.
• File Paths:
  • socktz_v8.exe - Filename of version 8 of the SockTz SOCKS5 proxy tool attempted to be executed in the CL-CRI-1163 campaign.
  • socktz_v9 - Filename of version 9 of the SockTz SOCKS5 proxy tool retrieved from attacker-controlled infrastructure in the CL-CRI-1163 campaign.
• Command Lines:
  • Purpose: Volume shadow copy creation for extracting sensitive files like NTDS.dit | Tools: vssadmin, cmd.exe | Stage: Credential Access | vssadmin create shadow /for=<volume>
  • Purpose: Copying files from shadow copy to a collection directory | Tools: cmd.exe, copy | Stage: Exfiltration | cmd.exe /c copy <source> <dest>
• Other:
  • exploit_creative.py - Filename of an exploit script with a descriptive adjective, suggesting LLM-driven iterative development in CL-CRI-1163.
  • exploit_careful.py - Filename of an exploit script with a descriptive adjective, suggesting LLM-driven iterative development in CL-CRI-1163.
  • rce_focused.py - Filename of an exploit script with a descriptive adjective, suggesting LLM-driven iterative development in CL-CRI-1163.