AI-Powered Intrusions Target Latin American Organizations

Threat actors leverage AI to streamline attacks on Mexican and Brazilian targets

Cybersecurity researchers have documented two ongoing intrusion campaigns targeting organizations across Latin America, where attackers are using artificial intelligence to enhance their operational capabilities while leaving critical security gaps in their infrastructure.

Palo Alto Networks Unit 42 identified two distinct activity clusters: one targeting Mexican transportation and government entities (tracked as CL-CRI-1131), and another focused on Brazil's financial sector (CL-CRI-1163). Despite their different geographic focuses, both campaigns share technical characteristics that signal a broader shift in regional threat tactics.

Mexican transportation campaign reveals AI troubleshooting in real time

During an April 2025 compromise, attackers struggled repeatedly to extract sensitive data from a Mexican transportation organization. The intrusion showed clear signs of trial-and-error execution consistent with large language model usage.

Attackers created multiple numbered batch scripts to collect data, inserting permission checks and troubleshooting connectivity issues across successive attempts. After failing to dump the Security Account Manager registry and domain controller files, they created shadow copies across multiple drives before successfully copying files.

Investigators traced exfiltration commands to infrastructure at 62.171.185[.]97, which led to the discovery of Let's Encrypt TLS certificates using DuckDNS domains. A multi-Subject Alternative Name certificate from February 2025 revealed five subdomains with names indicating operational functions: m-doxa-apodo (alias), m-doxa-geo (geolocation), m-doxa-intel (intelligence), and m-doxa-vacunas (vaccines in Spanish).

Critically, the IP address 178.128.87[.]160 hosted an instance of NextChat on TCP port 3000. NextChat is an open-source web interface that allows users to interact with multiple AI models simultaneously. This setup enabled attackers to compare responses across different language models and host prompts on their own infrastructure—but it also exposed their backend operations to researchers.

Brazilian financial campaign shows AI-generated exploit code

The second campaign targeted Brazilian financial institutions through job-themed phishing emails. Unlike the Mexican operation's reliance on built-in Windows utilities, this campaign deployed custom remote access trojans and tunneling tools.

Attackers attempted to install nine successive versions of a Go-based SOCKS5 proxy tool called SockTz within a two-hour window, suggesting repeated failures and rapid iteration. The staging server at 167.148.195[.]53 contained an open directory with hundreds of campaign scripts using iterative naming conventions: files appended with "_output" and exploit scripts named "exploit_creative.py," "exploit_careful.py," and "rce_focused.py."

These naming patterns strongly indicate language model-driven development, where attackers used AI to generate variations of exploit code.

Why it matters

These campaigns demonstrate that AI is lowering technical barriers for threat actors while simultaneously creating new defensive opportunities. Attackers can now use commercial language models to troubleshoot complex execution failures and generate exploit variations without deep technical expertise. However, their operational security practices haven't matured at the same pace. Exposed NextChat interfaces, open staging directories, and predictable infrastructure patterns give defenders clear visibility into attack operations. Organizations can exploit these OpSec failures to track and disrupt campaigns before they cause significant damage.

Overlapping infrastructure suggests coordinated evolution

Both activity clusters share SOCKS5 relay infrastructure and rely on commercial large language models to orchestrate operations. Rather than isolated incidents, Unit 42 assesses these represent independent threat groups adopting similar advanced techniques—a pattern that signals broader evolution in Latin America's threat landscape.

The findings were first reported by Palo Alto Networks Unit 42, with corroborating research from CloudSEK (which tracks CL-CRI-1131 as Operation Escaneo), Gambit, and Trend Micro.