Cybersecurity researchers have identified two active intrusion campaigns in Latin America that show how attackers are using artificial intelligence to work faster and solve technical problems.
The campaigns targeted Mexican transportation services, government ministries, water utilities, and Brazil’s financial sector. The first campaign, tracked as CL-CRI-1131, affected organizations in Mexico and Ecuador.
The attackers used “living-off-the-land” methods, meaning they relied mainly on legitimate Windows tools already installed on compromised systems.
This approach helps criminals avoid detection because they do not always need to deploy obvious malware.
During the attack, the group tried to steal highly sensitive information, including Windows Security Account Manager files and the Active Directory database file, NTDS.dit.
These files can contain password hashes and other identity data. The attackers created shadow copies of drives and ran several numbered batch scripts to collect files.
Their repeated failures and small changes to scripts suggested a trial-and-error process supported by large language models.
Researchers also found that the attackers hosted NextChat, an open-source AI chat interface, on their own infrastructure.
NextChat can connect users to different AI models, allowing operators to test prompts and compare answers. Hosting it themselves may have helped the attackers keep their prompts, scripts, and workflows under their control.
AI Hackers Target Latin Infrastructure
The second campaign, CL-CRI-1163, focused on Brazilian financial organizations. It appears to have begun with job-themed phishing emails carrying malicious attachments.
Once inside a network, the attackers deployed remote access Trojans, or RATs, which allow criminals to control infected devices from a distance.
This group also used a custom Go-based SOCKS5 proxy tool called SockTz. A SOCKS5 proxy can relay network traffic through compromised machines, helping attackers move through a victim’s environment and hide their real location.
Researchers observed the group trying several versions of the tool, from version 1 through version 9, within about two hours.
The attackers stored installers and scripts on open internet directories. Many files used iterative names, such as versions with “_output” added to the filename.
Other scripts had unusual labels such as “exploit_creative.py,” “exploit_careful.py,” and “rce_focused.py.” These patterns suggest that AI may have helped generate, revise, or organize the code.
Although the two campaigns targeted different countries and industries, they shared important features. Both used overlapping SOCKS5 relay infrastructure.
Both appeared to use commercial AI tools to troubleshoot failures, create scripts, and support post-compromise activity. This indicates that AI is becoming a practical force multiplier for threat actors in the region, unit42 said.
Indicators of Compromise
| IOC type | Indicator | Associated use / notes |
|---|---|---|
| Domain | m-doxa-apodo.duckdns[.]org | Data-exfiltration and campaign infrastructure; “apodo” means alias or nickname in Spanish |
| Domain | m-doxa-geo.duckdns[.]org | Likely geolocation-related operational infrast |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
