A recent analysis by Unit 42 details two ongoing, multi-stage network intrusion and data exfiltration campaigns targeting organizations across Latin America. These campaigns, tracked as CL-CRI-1131 and CL-CRI-1163, demonstrate a clear evolution in regional threat actor tooling, particularly through the leveraging of artificial intelligence (AI) and advanced proxy networks to streamline operations and overcome technical challenges during attacks.
Overview of AI-Assisted Data Exfiltration in Latin America
These threat clusters, while geographically distinct, share significant technical and behavioral overlaps, including the use of overlapping SOCKS5 relay infrastructure and commercial large language models (LLMs) for orchestrating operations. This indicates a broader trend where diverse threat groups in Latin America are independently adopting advanced proxy networks and AI integration. The primary objective of these campaigns appears to be data exfiltration, with observed activity in both the Mexican federal government and Brazilian financial sectors.
Technical Details and AI Integration
CL-CRI-1131: Mexican Federal Government Targeting
This cluster’s activity, observed as early as April 2026, focused on organizations within the Mexican federal government. During a compromise, attackers initially struggled with data collection, making repeated, unsuccessful attempts to dump the Security Account Manager (SAM) registry hive and the domain controller NTDS.dit file. These initial failures led to the creation of shadow copies across multiple drives before successful file copying, a sequence of trial-and-error actions highly consistent with LLM usage for troubleshooting.
The attackers utilized a series of numbered batch scripts, incorporating permissions checks, to collect sensitive data. Subsequent troubleshooting of connectivity with infrastructure at 62.171.185[.]97, an IP address used for data exfiltration, revealed an active Let’s Encrypt TLS certificate associated with m-doxa-apodo.duckdns[.]org. Further investigation showed that this infrastructure, established in February 2026, utilized multi-Subject Alternative Name (SAN) certificates, revealing operational subdomains likely targeting specific Mexican federal government entities.
The use of LLMs like Claude and GPT-4.1 to generate workaround scripts and overcome operational hurdles was further corroborated by the presence of an open-source NextChat instance hosted on 178.128.87[.]160 (TCP port 3000) during the April and June 2026 compromises. NextChat acts as a web interface for interacting with multiple LLMs, allowing attackers to compare models and ensure prompts are executed from attacker-controlled infrastructure. This setup strongly suggests the attackers relied on LLMs to dynamically generate necessary scripts after their initial attempts failed, providing a critical window into their backend operations.
CL-CRI-1163: Brazilian Financial Sector Targeting
An identical technical setup was observed in a secondary campaign, CL-CRI-1163, targeting the Brazilian financial sector. Unlike CL-CRI-1131, which largely relied on built-in Windows utilities, this campaign involved homebrewed malware. Initial access was likely gained through job-themed phishing compromises. Despite the difference in malware sophistication, the underlying operational shift remains consistent: exposed staging infrastructure showed operational scripts with filenames suggesting dynamic generation by an LLM rather than human development. This reinforces the conclusion that an AI-driven backend serves to enhance even sophisticated custom malware deployment.
Implications of NextChat for Malicious Operations
The observation of NextChat being used in these campaigns highlights a concerning trend: the integration of publicly available or open-source AI tools into threat actor arsenals. This allows less experienced attackers to leverage sophisticated capabilities for tasks like script generation and troubleshooting, reducing their reliance on advanced technical skills. The ability to quickly iterate on attack scripts and adapt to defensive measures using LLMs significantly lowers the barrier to entry for complex operations.
Actionable Recommendations and Mitigations
Organizations in Latin America, particularly those in government and financial sectors, should prioritize enhancing their defenses against these evolving tactics. To detect AI-driven threat actor tactics, consider the following:
- Monitor for Anomalous Script Execution: Implement advanced endpoint detection and response (EDR) solutions to identify unusual script execution patterns, especially those involving multiple iterations or rapid changes, which could indicate LLM-generated code.
- Enhance Network Traffic Analysis: Focus on detecting suspicious SOCKS5 proxy activity and connections to dynamic DNS services like DuckDNS, which are frequently used by these threat groups.
- Strengthen Phishing Defenses: Given the initial access vector in CL-CRI-1163, organizations should reinforce user awareness training and email filtering to combat job-themed phishing attempts.
- Implement Strict Access Controls: Regularly review and enforce least privilege principles to limit potential damage from successful intrusions, particularly regarding access to sensitive data like SAM and NTDS.dit files.
- Hunt for AI Tool Indicators: Actively scan for indicators of compromise (IoCs) related to AI tools, such as the presence of NextChat instances or unusual outbound connections to LLM APIs from internal networks.
- Threat Intelligence Integration: Stay updated with the latest threat intelligence on AI-assisted attack vectors and region-specific TTPs to proactively adjust defensive strategies.
Related: AI-Powered Internet Worm Prototype: Understanding the New Threat Model, LLMs Achieve Novel Cryptanalysis: Implications for Digital Security