Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

Unit 42 identified two ongoing attack campaigns—CL-CRI-1131 and CL-CRI-1163—targeting organizations in Latin America, leveraging AI tools to enhance operational efficiency. The Mexican transportation campaign (CL-CRI-1131) targeted government and transportation entities, using living-off-the-land techniques, volume shadow copy manipulation, and a self-hosted NextChat instance on IP 178.128.87.160 for AI-assisted scripting. The Brazilian financial campaign (CL-CRI-1163) involved phishing via resume-themed emails, deployment of a custom Go-based SOCKS5 proxy (SockTz), and use of AI-generated script names hosted on exposed infrastructure at 167.148.195.53. Both campaigns exhibited operational security failures, including exposed certificates and open directories, enabling threat researchers to track and analyze their infrastructure.

AI-extracted · verify before operational use