AI-Enabled Intrusions Target Latin American Organizations

Artificial intelligence is becoming part of the operational workflow for some attackers, but recent activity analyzed by Palo Alto Networks’ Unit 42 shows that technical acceleration does not necessarily produce disciplined operations. In two intrusion and data-exfiltration campaigns affecting organizations in Latin America, Unit 42 observed attackers using commercial large language models, self-hosted AI interfaces, custom malware, proxy infrastructure and iterative scripts.

The research describes two separate activity clusters: CL-CRI-1131, associated with a campaign involving a Mexican transportation organization and additional government and municipal targets in Mexico and Ecuador; and CL-CRI-1163, which targeted the Brazilian financial sector. Unit 42 treats them as distinct clusters because their geographic focus and tooling differ. However, the organization identified important technical and behavioral overlap, including SOCKS5 relay infrastructure and apparent use of AI to support intrusion operations.

The findings do not establish that a single actor conducted both campaigns. Instead, Unit 42 assesses that the overlap reflects a wider regional trend: different threat groups are adopting AI services and proxy networks to reduce the effort required for post-compromise activity.

Two campaigns, one emerging operating pattern

CL-CRI-1131 centered on a compromise observed in April 2026 involving a transportation organization. Unit 42 also connected the campaign’s targeting profile to federal government ministries and municipal water utilities in Mexico and Ecuador. The activity continued to leave infrastructure traces into June 2026.

In this campaign, operators primarily used built-in Windows capabilities and what Unit 42 characterizes as living-off-the-land activity. They ran a succession of numbered batch scripts to gather and exfiltrate sensitive material. The observed collection attempts included the Security Account Manager registry hive and the domain controller’s NTDS.dit database. When initial efforts failed, the operators created volume shadow copies across multiple drives before copying files.

Unit 42 observed repeated script revisions and troubleshooting steps, including a permissions check intended to confirm that files could be written to a collection directory. The researchers assess that this trial-and-error behavior is consistent with attackers using large language models to generate or repair scripts during the intrusion. That is an assessment, not proof that every observed command was produced by an AI system.

CL-CRI-1163 followed a different initial-access and execution pattern. Unit 42 reports that attackers likely gained access through a resume-themed phishing email attachment in February 2026. After access, the operators deployed multiple remote access Trojans and attempted to install a Go-based reverse SOCKS5 tunneling tool named SockTz.

The attackers tried versions 1 through 8 of SockTz from a compromised WordPress site within approximately two hours. After those attempts apparently failed to establish the desired proxy connection, they retrieved a ninth version from attacker-controlled infrastructure. Unit 42 identified the file as socktz_v9.exe in the source material.

The sequence illustrates how proxy tooling could support access to compromised systems and remote operations, while also exposing operational weaknesses. The campaign did not rely exclusively on Windows utilities: unlike CL-CRI-1131, it used custom-built implants and tunneling software. Nevertheless, Unit 42 identified a similar reliance on iterative troubleshooting and AI-assisted workflow management.

How the AI component appeared in the activity

The research does not describe an autonomous malware strain controlled directly by an AI model. Instead, it documents AI being incorporated into the attackers’ backend and working process.

For CL-CRI-1131, Unit 42 found an instance of the open-source NextChat interface hosted on attacker-associated infrastructure and exposed on TCP port 3000. NextChat allows users to interact with multiple language models through a web interface and can be self-hosted. In the researchers’ assessment, the interface provided an attacker-controlled location from which operators could compare model outputs and manage prompts.

Unit 42 linked this backend observation with the operators’ difficulties collecting sensitive files. The organization assesses that the attackers used large language models to produce workaround scripts and address execution problems. Earlier reporting referenced by Unit 42 associated the activity with use of Claude and GPT-4.1, but the supplied research does not provide enough information to determine which model generated any particular command.

In CL-CRI-1163, the evidence came largely from exposed staging infrastructure. The directory contained numerous scripts and files with iterative naming patterns, including names such as exploit_creative.py, exploit_careful.py and rce_focused.py. Other filenames used an _output suffix. Unit 42 assesses that these conventions suggest language-model-assisted development or repeated automated generation, rather than establishing that an LLM created every file.

The practical significance is less about AI novelty than about workflow efficiency. A language model can help an operator revise scripts, generate variations, troubleshoot errors and coordinate several post-compromise tasks. That may lower the skill threshold for managing a complex intrusion. At the same time, the exposed interfaces and directories show that the human operators did not consistently secure the systems supporting those workflows.

Proxy infrastructure and infrastructure reuse

SOCKS5 tooling played a prominent role in the Brazilian campaign. SockTz is described by Unit 42 as a Go-based reverse SOCKS5 proxy. The tool can provide a relay path through a compromised host, allowing operators to route traffic and conduct remote activity without communicating directly from their primary systems.

Unit 42 also found overlap between the two clusters’ SOCKS5 relay infrastructure. The research does not conclude that the overlap proves common ownership. It does, however, indicate that proxy infrastructure is an important part of the operational pattern observed across the campaigns.

The Mexican campaign exposed additional infrastructure through certificate and hosting analysis. A server at 62[.]171[.]185[.]97 was used for data exfiltration, according to Unit 42. Pivoting from that address led researchers to a Let’s Encrypt certificate associated with m-doxa-apodo[.]duckdns[.]org. Related subdomains included m-doxa-geo[.]duckdns[.]org, m-doxa-intel[.]duckdns[.]org, m-doxa-repuve[.]duckdns[.]org, m-doxa-sre[.]duckdns[.]org and m-doxa-vacunas[.]duckdns[.]org.

Unit 42 reported that certificate changes and host rotation provided a timeline for the infrastructure. The research identifies certificate SHA-256 fingerprints associated with hosts at 165[.]22[.]184[.]26 and 178[.]128[.]87[.]160. The latter address hosted the NextChat instance observed during the April and June activity.

These infrastructure details matter because they reveal how operational security failures can create tracking opportunities. The public exposure of a NextChat deployment, staging directories, script collections and certificate relationships gave researchers visibility into the attackers’ tooling and intended functions.

What organizations should do now

Defenders should treat the findings as both a malware and an operational-behavior problem. The following measures are general defensive recommendations informed by the activity described by Unit 42:

• Monitor unusual collection activity. Alert on attempts to access or copy the SAM registry hive and NTDS.dit, especially when preceded by shadow-copy creation or followed by large outbound transfers.
• Review script execution patterns. Numbered batch files, repeated execution failures, rapidly changing filenames and scripts that test write permissions deserve investigation when they appear on servers or domain controllers.
• Restrict administrative access to sensitive data. Apply least privilege, separate domain-controller administration from routine accounts and protect credential databases from unnecessary access.
• Inspect outbound proxy behavior. Look for unexpected SOCKS5-like tunneling, reverse proxy processes, connections to unfamiliar hosting providers and traffic routed through systems that do not normally act as relays.
• Harden externally reachable administration and development tools. Self-hosted AI interfaces, staging directories, open file listings and management panels should not be exposed to the public internet unless they are explicitly required and strongly authenticated.
• Investigate phishing delivery paths. Resume- and job-themed attachments should receive heightened scrutiny. Email security controls should examine attachment behavior, while endpoint controls should record the child processes and network connections that follow document or archive execution.
• Hunt across infrastructure relationships. Certificate fingerprints, dynamic DNS names, resolved addresses and repeated naming conventions can help identify related activity. Defenders should validate indicators against current telemetry before blocking them.
• Protect AI usage and sensitive prompts. Organizations using AI services should apply access controls, logging and data-loss safeguards. They should also look for unauthorized self-hosted model interfaces or unusual outbound connections to AI-related services from compromised systems.

Because the source research identifies exposed infrastructure as a major discovery opportunity, security teams should include internet-facing asset review in their response process. Publicly accessible directories, forgotten test servers, weakly protected administration interfaces and certificates covering multiple operational subdomains can reveal more than intended.

Indicators reported by Unit 42

The following indicators are reproduced in defanged form from the supplied Palo Alto Unit 42 research. Their presence alone does not prove compromise:

• Domains: m-doxa-apodo[.]duckdns[.]org, m-doxa-geo[.]duckdns[.]org, m-doxa-intel[.]duckdns[.]org, m-doxa-repuve[.]duckdns[.]org, m-doxa-sre[.]duckdns[.]org and m-doxa-vacunas[.]duckdns[.]org.
• IP addresses: 62[.]171[.]185[.]97, 165[.]22[.]184[.]26, 178[.]128[.]87[.]160 and 167[.]148[.]195[.]53.
• File hashes: 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c, 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5, 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8, a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 and 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec.
• File and tool references: SockTz, socktz_v9.exe and a source URL rendered as hxxp[:]//167[.]148[.]195[.]53:8888/socktz_v9.exe.

Conclusion

Palo Alto Unit 42’s analysis shows attackers using AI as a practical support layer for scripting, troubleshooting and post-compromise coordination. The campaigns combined that assistance with living-off-the-land activity, custom implants, data collection and SOCKS5 proxying.

The strongest defensive lesson is that AI-assisted operations can still leave conventional traces. Repeated script revisions, anomalous credential-database access, proxy connections, exposed staging systems and certificate reuse provide opportunities for detection and disruption. Organizations should therefore combine endpoint and network monitoring with disciplined exposure management, rather than treating AI use as an entirely new or invisible category of threat.

Sources

Palo Alto Unit 42: Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America