Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

1. Executive summary

Unit 42 has published details of two ongoing, multi-stage intrusion and data-exfiltration campaigns targeting Latin American organizations — CL-CRI-1131 (Mexican transportation sector, plus federal government ministries and municipal water utilities in Mexico and Ecuador) and CL-CRI-1163 (Brazilian financial sector). Both clusters use living-off-the-land techniques, custom RATs and SOCKS5 proxy/tunneling tooling, and — notably — show strong evidence of attacker use of commercial large language models to generate and debug operational scripts, including a Go-based SOCKS5 proxy with iterative AI-style filenames. The Brazilian campaign expands previously reported job-themed phishing against vulnerable web servers into the financial sector. No CISA-KEV exploitation state, CVSS scoring, or named CVE is associated with this item — verified reference data did not resolve for this advisory, so no severity re-assessment is offered. For EMEA financial services, the direct exposure is limited (targeting is LATAM-focused), but the TTPs — LLM-assisted batch scripting, dynamic-DNS exfiltration endpoints, and shared SOCKS5 relay infrastructure — are transferable and warrant detection coverage now.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged beyond these; UK NIS 2018 duties are not specifically triggered by this item for EMEA clients absent UK-exposed infrastructure matching the described targeting.

3. Technical analysis & attack chain

Confirmed attack chain — CL-CRI-1131 (Mexican transportation campaign)

1. Initial access vector not detailed in the source material; the intrusion was observed in April 2026 at a transportation organization, with related targeting of federal government ministries and municipal water utilities in Mexico and Ecuador.
2. The attacker attempted to dump the Security Account Manager (SAM) registry hive and the domain controller NTDS.dit file — repeatedly, with failures.
3. On failure, the attacker created shadow copies across multiple drives and copied files from those shadow copies.
4. The attacker ran a series of numbered batch scripts to collect sensitive data from the compromised host, inserting a permissions check to ensure successful file writes to the collection directory. The trial-and-error pattern and successive script fixes are assessed by Unit 42 as consistent with LLM usage.
5. The attacker troubleshoot connectivity with exfiltration infrastructure at 62.171.185[.]97.
6. Operators self-hosted NextChat (an open-source ChatGPT-style web UI) on operational infrastructure to orchestrate operations via commercial LLMs.
7. Infrastructure persisted into June 2026. Pivoting on the exfiltration IP revealed an active Let's Encrypt TLS certificate for m-doxa-apodo.duckdns[.]org, following a unique dynamic-DNS naming standard. Searching the m-doxa prefix showed the attackers established campaign infrastructure in February 2026 using a single consolidated multi-SAN certificate covering five active subdomains, whose names reveal operational targeting profiles.

Confirmed attack chain — CL-CRI-1163 (Brazilian financial campaign)

1. Expansion of previously reported job-themed phishing targeting vulnerable web servers, now directed at the Brazilian financial sector.
2. Attackers deployed custom remote access Trojans (RATs) and tunneling tools.
3. Tooling includes a Go-based SOCKS5 proxy with iterative filenames that suggest AI-enablement (i.e., generated in successive LLM iterations).
4. Both clusters share overlapping SOCKS5 relay infrastructure and both rely on AI to orchestrate operations via commercial LLMs.

Technical specifics relevant to defenders: living-off-the-land execution; batch-script-based staged collection with numbered filenames; SAM hive and NTDS.dit dumping attempts; volume shadow copy creation as a collection fallback; dynamic DNS (DuckDNS) with Let's Encrypt TLS for exfiltration endpoints; self-hosted NextChat on attacker infrastructure; Go-based SOCKS5 proxying.

Confidence caveats: All technical detail in this advisory is single-sourced — it derives from one vendor report (Unit 42). No second source corroborates the IOCs, the cluster tracking IDs, or the LLM-enablement assessment. The LLM-usage attribution is an inference from behavioral evidence (iterative filenames, trial-and-error scripting), not from a confirmed tool or actor claim; treat it as assessed, not proven. No MITRE ATT&CK actor profile exists for CL-CRI-1131 or CL-CRI-1163 in the verified reference data — attribution is unconfirmed; these are Unit 42 internal cluster identifiers, not named threat groups. The source content provided is truncated mid-sentence ("These subdomain names indicate their operational…"); details of the five subdomains, the Brazilian campaign's full toolset, and any additional IOCs were not available at time of writing.

4. Mitigation & containment

P1 — within 24 hours

• Block 62.171.185[.]97 at perimeter egress and on proxy/secure web gateway policies.
• Block and sinkhole the domain m-doxa-apodo.duckdns[.]org and alert on any TLS sessions presenting certificates whose SANs match the m-doxa-prefixed DuckDNS naming pattern. Note: the five subdomains under the multi-SAN certificate are not enumerated in the available source; hunt on the prefix pattern rather than a fixed list.
• Hunt for the described collection sequence: vssadmin/wmic shadowcopy volume shadow copy creation followed by batch-file execution writing to a staging directory, and failed-then-successful SAM/NTDS access attempts (Event IDs 4656/4663 on C:\Windows\System32\config\SAM, NTDS.dit access attempts).

P2 — within 72 hours

• Audit externally facing web servers for the vulnerable-server exposure used as the initial-access foothold in the Brazilian financial campaign; prioritize internet-facing recruitment/job-application functionality given the job-themed phishing lure.
• Review egress for SOCKS5 patterns consistent with Go-based proxy tooling — long-lived outbound connections to non-standard ports with SOCKS5 handshake signatures — and to DuckDNS-resolved endpoints.
• Restrict vssadmin.exe and wmic.exe shadow-copy operations to authorized administrators via AppLocker/WDAC or equivalent.

P3 — within 7 days

• Baseline and monitor for numbered batch scripts (e.g., sequentially named .bat files) appearing in staging or temp directories; alert on batch files containing permission-check logic prior to copy operations.
• If your organization operates self-hosted AI chat UIs, ensure NextChat or equivalent is not internet-exposed without authentication — the same class of tool was observed self-hosted on attacker infrastructure, and defenders should also hunt for unexpected NextChat instances on their own estate.
• Review third-party and subsidiary exposure in LATAM jurisdictions against the described targeting profile (transportation, government ministries, water utilities, financial sector).

5. Indicators of compromise

ipv4  62.171.185[.]97
domain  m-doxa-apodo.duckdns[.]org

Behavioural indicators (no further atomic IOCs are available in the source material):

6. Detection

The source provides limited atomic artefacts usable for rule authoring. The following rules are built strictly from strings present in the source material.

rule Unit42_CL_CRI_1131_NextChat_SelfHosted_Infra
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-03"
        reference = "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/"
        description = "Detects self-hosted NextChat web UI artefacts associated with CL-CRI-1131 attacker infrastructure. Strings drawn from Unit 42 reporting."
    strings:
        $nextchat = "NextChat" ascii
        $duckdns = "duckdns.org" ascii
        $mdoxa = "m-doxa" ascii
    condition:
        2 of them
}

title: Suspicious Volume Shadow Copy Creation Followed by Batch Script Execution
id: 7f3c1a2e-9b4d-4e5f-8a6b-1c2d3e4f5a6b
status: experimental
description: >
  Detects the CL-CRI-1131 collection pattern: shadow copy creation across
  multiple drives followed by execution of numbered batch scripts, consistent
  with SAM/NTDS collection fallback behaviour reported by Unit 42.
references:

  - https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/
author: Adverse Trace
date: 2026-09-03
logsource:
    product: windows
    category: process_creation
detection:
    selection_shadowcopy:
        CommandLine|contains:

            - 'vssadmin create shadow'
            - 'wmic shadowcopy call create'
    selection_batch:
        CommandLine|contains:

            - '.bat'
    filter:
        CommandLine|contains:

            - 'vssadmin list shadows'
    condition: selection_shadowcopy or (selection_batch and not filter)
falsepositives:

    - Legitimate backup operations
    - Administrator-driven shadow copy creation
level: high

Caveat: the YARA rule keys on strings from the reporting (NextChat, duckdns.org, m-doxa) that describe the attacker's infrastructure choices; it will match artefacts referencing these, not the malware itself — no malware hashes, mutexes, or embedded strings were available in the source material. Treat both rules as hunting aids pending fuller IOC release.

7. Sources

• Palo Alto Networks Unit 42, "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America," https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/, 2026-09-03.

8. Adverse Trace position

This is a threat-campaign advisory, not a vulnerability item; no CVSS or CISA-KEV state applies, and verified reference data did not resolve for this item, so we offer no independent severity score. The material risk to EMEA financial services is low-to-moderate: targeting is LATAM-focused, but clients with Brazilian or Mexican subsidiaries, shared SOCKS5 relay exposure, or internet-facing web servers matching the described foothold profile should treat the IOCs as immediately actionable. The single most important takeaway is operational: LLM-assisted attackers produce iterative, error-prone, script-heavy intrusions — which are noisy. Detection engineering against numbered batch scripts, shadow-copy-then-copy sequences, and dynamic-DNS exfiltration endpoints will catch this class of activity regardless of actor. All IOCs and the LLM-enablement assessment are single-sourced from Unit 42; verify before enforcement, and note the source was truncated at time of writing — we will re-issue with the full subdomain list and Brazilian-campaign toolset details when the complete report is available. We are monitoring for corroboration from additional vendors and for any emergence of these clusters against EMEA targets.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.