AI Tool Use in Latin American Cyberattacks Exposed

Executive Summary

This report details two ongoing, multi-stage cyber campaigns targeting organizations in Latin America, primarily in Mexico and Brazil. Researchers at Unit 42 have identified two activity clusters, CL-CRI-1131 and CL-CRI-1163, which demonstrate a significant evolution in the regional threat landscape: the integration of Artificial Intelligence (AI) and Large Language Models (LLMs) into their operational toolchain. The attackers use commercial LLMs like Claude and GPT-4.1 to generate scripts, troubleshoot technical obstacles, and orchestrate data exfiltration. The campaigns share overlapping SOCKS5 proxy infrastructure and target sensitive sectors, including government, transportation, and finance. Poor operational security by the attackers, including exposed infrastructure, has provided critical insights into their methods and increasing reliance on AI to streamline attacks.

Threat Overview

Two distinct but related threat clusters are actively targeting entities in Latin America. CL-CRI-1131 focuses on Mexican federal government and transportation organizations, while CL-CRI-1163 targets the Brazilian financial sector. Despite their different geographic targets and methods—CL-CRI-1131 uses living-off-the-land techniques while CL-CRI-1163 deploys custom malware—both campaigns share critical TTPs that signal a broader trend.

The core of this trend is the operational use of AI. The attackers leverage an open-source tool called NextChat, hosted on their own infrastructure, to interact with multiple LLMs. This allows them to generate and refine malicious scripts in real-time. During an observed intrusion by CL-CRI-1131 in April 2026, the attacker demonstrated a trial-and-error approach consistent with LLM usage, struggling to dump credentials from the SAM hive and NTDS.dit file before successfully using shadow copies.

Initial access for the CL-CRI-1163 campaign is believed to be through job-themed phishing attacks. Both groups make extensive use of a shared SOCKS5 proxy network for anonymity and dynamic DNS services like duckdns.org for resilient command-and-control (C2) infrastructure.

Technical Analysis

The technical execution of these campaigns reveals a blend of common and advanced techniques, augmented by AI.

CL-CRI-1131: Living-off-the-Land with AI Assistance

This cluster relies heavily on built-in Windows tools, with LLMs providing the logic. Key observed actions include:

1. Credential Access (T1003): The attacker made repeated, unsuccessful attempts to directly access and copy the Security Account Manager (SAM) registry hive and the Active Directory database (NTDS.dit).
2. Script Generation (T1059.003): After initial failures, the attacker used a series of numbered batch scripts, likely generated by an LLM, to automate data collection. The scripts included permission checks, indicating iterative refinement.
3. Defense Evasion (T1565.002): The attacker successfully used Volume Shadow Copies (VSS) to create a snapshot of the system, allowing them to copy the locked SAM and NTDS.dit files without interruption.
4. C2 Infrastructure: The attackers used the IP 62.171.185[.]97 for data exfiltration, linked to the dynamic DNS domain m-doxa-apodo.duckdns[.]org. Analysis of TLS certificates revealed a multi-SAN certificate exposing other subdomains, indicating intended targets within the Mexican government.

CL-CRI-1163: Custom Malware and Phishing

This cluster, targeting Brazil's financial sector, uses a more sophisticated approach but with the same AI-driven backend.

1. Initial Access (T1566): Initial access was likely gained via a job-themed phishing campaign.
2. Custom Implants: Unlike CL-CRI-1131, this group uses custom-built malware. However, exposed staging infrastructure revealed operational scripts with filenames suggesting they were dynamically generated by an LLM.

Shared Infrastructure and AI Tooling

Both clusters leverage a shared SOCKS5 proxy network and an instance of NextChat hosted on 178.128.87[.]160:3000. NextChat provides a web interface for the attackers to query various LLMs, compare their outputs, and generate code, all while keeping the prompts on attacker-controlled infrastructure. This setup indicates a deliberate strategy to integrate AI into the attack lifecycle for increased efficiency and adaptability.

Impact Assessment

The targeting of government, transportation, and financial sectors poses a significant risk to national security and economic stability in the affected Latin American countries. Successful exfiltration of NTDS.dit files could lead to a full domain compromise, giving attackers access to all user accounts, passwords, and sensitive data within the organization's network. For the Brazilian financial institutions, a breach could result in financial theft, customer data loss, and erosion of trust in the banking system. The use of AI suggests that these threat actors can adapt and overcome defensive measures more quickly than traditional attackers, potentially reducing the time from initial compromise to significant impact.

IOCs — Directly from Articles

The following indicators of compromise were explicitly mentioned in the source report.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns, which could indicate related activity:

Detection & Response

Detecting these AI-assisted attacks requires a focus on behavioral anomalies and infrastructure patterns.

1. Monitor Command-Line and Scripting: Implement enhanced logging for PowerShell (T1059.001) and Windows Command Shell (T1059.003). Use EDR solutions to alert on suspicious command chains, especially the use of vssadmin.exe followed by file copy operations from the shadow copy path (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*).
2. Network Traffic Analysis: Per D3FEND technique Network Traffic Analysis (D3-NTA), filter and alert on outbound traffic to dynamic DNS providers like duckdns.org. Profile normal network behavior and flag connections to unusual ports or IP ranges associated with proxies.
3. Behavioral Analytics: Employ User and Entity Behavior Analytics (UEBA) to detect anomalous account activity, such as a user account suddenly running numerous reconnaissance scripts or attempting to access sensitive files like NTDS.dit.
4. Endpoint Detection and Response (EDR): An EDR tool is critical for identifying the living-off-the-land techniques used. EDR can correlate the sequence of events, from script execution to shadow copy creation and network connections, to identify the attack chain.

Mitigation

Defenders can take several steps to mitigate the risk from these and similar threats.

• Restrict Dynamic DNS: Implement D3FEND's DNS Denylisting (D3-DNSDL). If your organization does not have a business need for dynamic DNS services, create firewall or proxy rules to block outbound connections to known dynamic DNS providers.
• Application Control: Use application control solutions like AppLocker to restrict the execution of unauthorized scripts. This aligns with MITRE ATT&CK Mitigation M1038 - Execution Prevention.
• Protect Credentials: Harden systems to prevent credential dumping. Ensure that access to domain controllers is heavily restricted. Implement Privileged Access Management (PAM) solutions (M1026) to control and monitor access to administrative accounts.
• User Training: Since one cluster used phishing for initial access, ongoing user security training (M1017) is essential to reduce the likelihood of compromise.
• Endpoint Hardening: Reduce the attack surface by hardening endpoints. This includes disabling unnecessary services and applying the principle of least privilege, aligning with D3FEND's Platform Hardening (D3-PH).