# AI-Assisted Campaigns Target Latin American Organizations

> Ongoing multi-stage network intrusions and data exfiltration campaigns in Latin America leverage AI tools to enhance operations.

- Published: 2026-09-03T12:24:28.000Z
- Severity: high
- Category: Threat Intel
- Tags: AI, Data Exfiltration, Latin America, LLM, NextChat
- Author: Runtime Rebel Intel
- Primary source: https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/
- Canonical: https://runtimerebel.com/blog/ai-assisted-campaigns-target-latin-american-organizations

## Key points

- Immediate impact: Multi-stage network intrusions and data exfiltration are actively targeting Latin American organizations.
- Affected systems: Organizations in the Mexican federal government and Brazilian financial sectors are specifically impacted.
- Remediation: Enhance detection capabilities for AI-assisted TTPs and advanced SOCKS5 proxy network usage.

A recent analysis by [Unit 42](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/) details two ongoing, multi-stage network intrusion and [data exfiltration](/glossary#data-exfiltration) campaigns targeting organizations across Latin America. These campaigns, tracked as CL-CRI-1131 and CL-CRI-1163, demonstrate a clear evolution in regional [threat actor](/glossary#threat-actor) tooling, particularly through the leveraging of artificial intelligence ([AI](/glossary#ai)) and advanced proxy networks to streamline operations and overcome technical challenges during attacks.

## Overview of AI-Assisted Data Exfiltration in Latin America

These threat clusters, while geographically distinct, share significant technical and behavioral overlaps, including the use of overlapping SOCKS5 relay infrastructure and commercial large language models (LLMs) for orchestrating operations. This indicates a broader trend where diverse threat groups in Latin America are independently adopting advanced proxy networks and AI integration. The primary objective of these campaigns appears to be data exfiltration, with observed activity in both the Mexican federal government and Brazilian financial sectors.

### Technical Details and AI Integration

**CL-CRI-1131: Mexican Federal Government Targeting**

This cluster's activity, observed as early as April 2026, focused on organizations within the Mexican federal government. During a compromise, attackers initially struggled with data collection, making repeated, unsuccessful attempts to dump the Security Account Manager (SAM) registry hive and the domain controller NTDS.dit file. These initial failures led to the creation of shadow copies across multiple drives before successful file copying, a sequence of trial-and-error actions highly consistent with [LLM](/glossary#jailbreak-llm) usage for troubleshooting.

The attackers utilized a series of numbered batch scripts, incorporating permissions checks, to collect sensitive data. Subsequent troubleshooting of connectivity with infrastructure at `62.171.185[.]97`, an IP address used for data exfiltration, revealed an active Let's Encrypt [TLS](/glossary#transport-layer-security-tls) certificate associated with `m-doxa-apodo.duckdns[.]org`. Further investigation showed that this infrastructure, established in February 2026, utilized multi-Subject Alternative Name (SAN) certificates, revealing operational subdomains likely targeting specific Mexican federal government entities.

The use of LLMs like Claude and GPT-4.1 to generate workaround scripts and overcome operational hurdles was further corroborated by the presence of an open-source NextChat instance hosted on `178.128.87[.]160` (TCP port 3000) during the April and June 2026 compromises. NextChat acts as a web interface for interacting with multiple LLMs, allowing attackers to compare models and ensure prompts are executed from attacker-controlled infrastructure. This setup strongly suggests the attackers relied on LLMs to dynamically generate necessary scripts after their initial attempts failed, providing a critical window into their backend operations.

**CL-CRI-1163: Brazilian Financial Sector Targeting**

An identical technical setup was observed in a secondary campaign, CL-CRI-1163, targeting the Brazilian financial sector. Unlike CL-CRI-1131, which largely relied on built-in Windows utilities, this campaign involved homebrewed [malware](/glossary#malware). [Initial access](/glossary#initial-access) was likely gained through job-themed [phishing](/glossary#phishing) compromises. Despite the difference in malware sophistication, the underlying operational shift remains consistent: exposed staging infrastructure showed operational scripts with filenames suggesting dynamic generation by an [LLM](/glossary#llm) rather than human development. This reinforces the conclusion that an AI-driven backend serves to enhance even sophisticated custom malware deployment.

### Implications of NextChat for Malicious Operations

The observation of NextChat being used in these campaigns highlights a concerning trend: the integration of publicly available or open-source AI tools into threat actor arsenals. This allows less experienced attackers to leverage sophisticated capabilities for tasks like script generation and troubleshooting, reducing their reliance on advanced technical skills. The ability to quickly iterate on attack scripts and adapt to defensive measures using LLMs significantly lowers the barrier to entry for complex operations.

## Actionable Recommendations and Mitigations

Organizations in Latin America, particularly those in government and financial sectors, should prioritize enhancing their defenses against these evolving tactics. To detect AI-driven threat actor tactics, consider the following:

*   **Monitor for Anomalous Script Execution**: Implement advanced [endpoint](/glossary#endpoint) detection and response ([EDR](/glossary#edr)) solutions to identify unusual script execution patterns, especially those involving multiple iterations or rapid changes, which could indicate LLM-generated code.
*   **Enhance Network Traffic Analysis**: Focus on detecting suspicious SOCKS5 proxy activity and connections to dynamic DNS services like DuckDNS, which are frequently used by these threat groups.
*   **Strengthen Phishing Defenses**: Given the initial access vector in CL-CRI-1163, organizations should reinforce user awareness training and email filtering to combat job-themed phishing attempts.
*   **Implement Strict Access Controls**: Regularly review and enforce [least privilege](/glossary#least-privilege) principles to limit potential damage from successful intrusions, particularly regarding access to sensitive data like SAM and NTDS.dit files.
*   **Hunt for AI Tool Indicators**: Actively scan for indicators of compromise (IoCs) related to AI tools, such as the presence of NextChat instances or unusual outbound connections to LLM APIs from internal networks.
*   **[Threat Intelligence](/glossary#threat-intelligence) Integration**: Stay updated with the latest threat intelligence on AI-assisted attack vectors and region-specific TTPs to proactively adjust defensive strategies.

**Related:** [AI-Powered Internet Worm Prototype: Understanding the New Threat Model](/blog/ai-powered-internet-worm-prototype-understanding-the-new-threat-model), [LLMs Achieve Novel Cryptanalysis: Implications for Digital Security](/blog/llms-achieve-novel-cryptanalysis-implications-for-digital-security)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/ai-assisted-campaigns-target-latin-american-organizations