Overview
Unit 42 researchers Reese Lewis and Sara McBroom have documented two concurrent, multi-stage intrusion campaigns targeting Latin American organisations, both of which show clear evidence of operational AI integration. Tracked as CL-CRI-1131 (Mexico/Ecuador, transportation and government focus) and CL-CRI-1163 (Brazil, financial sector focus), the campaigns are attributed to distinct threat groups but share overlapping SOCKS5 relay infrastructure and a common pattern: the use of commercial large language models to plan, iterate, and orchestrate attack execution.
This marks a meaningful shift in observed threat actor behaviour in the region — AI tooling is no longer theoretical; it is being operationally embedded into intrusion workflows.
Technical Analysis
CL-CRI-1131 — Mexican Transportation Campaign During an April 2026 compromise, operators exhibited classic LLM-assisted trial-and-error behaviour. Repeated failed attempts to dump the SAM registry hive and NTDS.dit file were followed by volume shadow copy manipulation — a pattern consistent with iterative troubleshooting via LLM prompting. The attackers used a series of sequentially numbered batch scripts to collect and exfiltrate sensitive data, a naming convention that strongly implies AI-generated or AI-iterated scripting. Critically, the group self-hosted a NextChat instance on operational infrastructure, providing a direct interface to commercial LLMs (including ChatGPT and Claude) from within their attack environment.
CL-CRI-1163 — Brazilian Financial Campaign This cluster expanded on previously reported job-themed phishing campaigns targeting vulnerable web servers. Attackers deployed custom remote access Trojans (RATs) and a Go-based SOCKS5 proxy tool with iterative filenames — again suggestive of AI-assisted development or iteration. The campaign demonstrates how AI tooling can accelerate custom malware development cycles.
Both clusters share SOCKS5 relay infrastructure, suggesting possible resource sharing or procurement from a common criminal marketplace, even if operational goals differ.
Framework Mapping
- AML.T0047 (AI-Enabled Product or Service): Attackers operationalised commercial LLMs (ChatGPT, Claude) as a direct component of their intrusion workflow.
- AML.T0065 (LLM Prompt Crafting): The iterative batch script naming and trial-and-error execution pattern strongly implies structured prompting to generate and refine attack tooling.
- AML.T0114 (AI Service Web Interface): Self-hosted NextChat instances provided a controlled LLM interface within the attack infrastructure.
- LLM08 (Excessive Agency): LLMs were granted implicit operational agency over attack planning and script generation without guardrails preventing malicious use.
Impact Assessment
Organisations in Latin American transportation, financial services, and government sectors face elevated risk. The use of AI lowers the technical barrier for attackers, enabling more rapid iteration on evasion and data collection techniques. The campaign’s persistence from April through June 2026 and its breadth across Mexico, Ecuador, and Brazil indicate sustained, resourced operations rather than opportunistic incidents.
Mitigation & Recommendations
- Block unauthorised LLM interfaces: Detect and restrict self-hosted NextChat or similar LLM front-ends on enterprise and operational networks.
- Monitor batch script sequencing: Alert on numbered or sequentially named script execution chains, which may indicate AI-guided iterative attack behaviour.
- Restrict SOCKS5 egress: Implement strict egress filtering to detect tunnelling activity consistent with both clusters’ relay infrastructure.
- Harden shadow copy access: Monitor and restrict VSS manipulation, a key indicator in the CL-CRI-1131 intrusion.
- Phishing resilience: Reinforce defences against job-themed lure documents targeting web-exposed services in the financial sector.