Two Cyberattack Campaigns in Latin America Exploit Artificial Intelligence

Two multi-stage intrusion campaigns are targeting organizations in Latin America, with malicious actors leveraging artificial intelligence to enhance their operational capabilities. The activities, identified as CL-CRI-1131 and CL-CRI-1163, are aiming at strategic sectors in Mexico and Ecuador, and the Brazilian financial sector.

Quick Response

The campaigns exploit Living-off-the-land techniques and custom malware, with actors using advanced language models to orchestrate operations. Both clusters share SOCKS5 infrastructure and data exfiltration techniques.

Mexican Campaign: Strategic Targets and Sophisticated Techniques

The CL-CRI-1131 campaign has targeted a transportation organization, federal government ministries, and municipal water utilities in Mexico and Ecuador. The attackers used Living-off-the-land (LotL) techniques, executing iterative batch scripts to manipulate and exfiltrate sensitive data. They also hosted self-hosted instances of NextChat on their operational infrastructure.

During a compromise in April 2026, the attackers showed difficulties in collecting sensitive data, repeatedly attempting to download the SAM registry hive and the NTDS.dit file of the domain controller. They created shadow copies on multiple disks before copying the files, indicating a trial-and-error process consistent with the use of advanced language models.

Infrastructure and Certificates: Evolution of Operations

Analyzing the IP 62.171.185[.]97 used for data exfiltration, we discovered an active Let's Encrypt TLS certificate using the domain m-doxa-apodo.duckdns[.]org. The m-doxa prefix revealed five active subdomains, each with specific operational functions and Mexican government targets.

The campaign's infrastructure was established in February 2026 with a single multi-Subject Alternative Name (SAN) certificate. By April and June 2026, the attackers rotated the infrastructure, generating new multi-SAN certificates, as shown in the certificates table.

Brazilian Campaign: Custom Malware and Initial Access

The CL-CRI-1163 campaign targeted the Brazilian financial sector, expanding a previous work-themed phishing campaign that exploited vulnerable web servers. The attackers employed custom Trojans for remote access (RAT) and tunneling tools, including a Go-based SOCKS5 proxy with iterative file names suggesting AI enablement.

The attackers gained initial access through a CV-themed phishing attachment in February 2026. After downloading multiple RATs, they attempted to install versions 1 to 8 of a reverse SOCKS5 tunneling tool called SockTz from a compromised WordPress site. After failing to install, they retrieved version 9 from attacker-controlled infrastructure.

The Integration of AI: A Regional Trend

Both clusters share SOCKS5 infrastructure and use commercial language models to orchestrate operations. This indicates a broader evolution in the regional threat landscape, with diverse groups adopting advanced proxy networks and AI integration to optimize their operations.

The use of NextChat as an interface to interact with multiple language models suggests that the attackers are leveraging AI to generate working scripts and solve operational problems. This trend, observed in both the Mexican and Brazilian campaigns, lowers the barrier to entry for managing complex post-exploitation workflows.

Implications for Cybersecurity and cyber insurance

The adoption of sophisticated techniques and the integration of AI in cyberattack operations require a proactive approach to cybersecurity. Organizations must invest in advanced Managed Detection and Response (MDR) solutions and strengthen their incident response capabilities to counter these emerging threats.

Furthermore, understanding regional trends and adopting NIS2 compliance measures are crucial to mitigating the risks associated with these cyberattack campaigns.

Recommendations for protecting critical infrastructures

For affected organizations, it is essential to implement advanced security measures, including SIEM and Data Loss Prevention (DLP) solutions. Continuous monitoring of infrastructure and adoption of zero trust architecture practices can help prevent future compromises.

Organizations should also consider purchasing cyber risk policies to mitigate financial losses resulting from data breaches and operational disruptions.

Threat Evolution: AI as a Force Multiplier

The integration of advanced language models into cyberattack operations represents a turning point in the regional threat landscape. Attackers are leveraging these technologies to generate working scripts, solve operational problems, and optimize data exfiltration processes. This approach significantly lowers the technical skill threshold required to conduct complex operations, democratizing access to advanced cyberattack capabilities.

The use of NextChat as an interface to interact with multiple commercial language models, including Claude and GPT-4.1, suggests a concerning trend towards the adoption of commercial AI tools by threat actors. This phenomenon, detailed in the report "The AI-Assisted Breach of Mexico’s Government Infrastructure," indicates that attackers are rapidly adapting consumer AI technologies for malicious purposes.

SOCKS5 Infrastructure: A Key Element in Threat Evolution

The shared SOCKS5 infrastructure between the two campaigns reveals a growing level of operational sophistication. The attackers have established an advanced proxy relay system that enables protected communications and data transfers. This infrastructure, combined with the use of Let's Encrypt TLS certificates, demonstrates a deep understanding of concealment techniques and defensive cybersecurity practices.

The analysis of TLS certificates associated with the CL-CRI-1131 campaign shows a significant evolution in operational infrastructure. The attackers started with a single multi-SAN certificate in February 2026 but subsequently rotated the infrastructure, generating new multi-SAN certificates in April and June 2026. This certificate rotation strategy suggests a deliberate attempt to evade detection and maintain persistent access to compromised networks.

Impact on the Insurance Sector: Rising Cyber Insurance Costs

The adoption of sophisticated techniques and the integration of AI in cyberattack operations are having a significant impact on the cyber insurance market. Insurance companies are reviewing their risk models and premiums, with an expected 15-20% increase in cyber risk policy costs in 2027. This increase is attributed to the greater complexity and difficulty in mitigating emerging threats.

Organizations must therefore carefully consider their insurance coverage options and assess the potential financial impact of a security incident. Purchasing adequate cyber risk policies can provide essential financial security in the event of data breaches and operational disruptions.

Compliance Challenges: Adapting to NIS2 and DORA Regulations

The recent cyberattack campaigns in Latin America underscore the importance of rigorous compliance with cybersecurity regulations, particularly the NIS2 directive and the DORA regulation. These regulations impose stringent requirements for risk management, incident reporting, and digital operational resilience.

Organizations must therefore assess their current compliance practices and implement additional measures to meet regulatory requirements. This may include adopting advanced Security Information and Event Management (SIEM) solutions and conducting regular security audits to identify and remediate vulnerabilities.

Future Outlook: Evolution of the Threat Landscape

The integration of AI into cyberattack operations represents just the beginning of a broader trend towards the adoption of advanced technologies by threat actors. Hacking groups are expected to continue exploring new AI applications, such as automating attack phases and developing more sophisticated malware.

Organizations must therefore remain vigilant and adopt a proactive approach to cybersecurity. This includes investing in advanced Managed Detection and Response (MDR) solutions and conducting regular incident response exercises to ensure operational readiness.

Frequently Asked Questions

Which sectors are most affected by these cyberattack campaigns?

The campaigns have primarily targeted the transportation sector, federal government ministries, municipal water utilities, and the financial sector in Latin America.

How can organizations protect themselves from these threats?

What is the impact of AI integration on cyberattack operations?

The integration of AI lowers the technical skill threshold required to conduct complex operations, democratizing access to advanced cyberattack capabilities and enabling attackers to generate working scripts and solve operational problems more effectively.

Which cybersecurity regulations are relevant to these threats?

Relevant regulations include the NIS2 directive and the DORA regulation, which impose stringent requirements for risk management, incident reporting, and digital operational resilience.

What are the future prospects for the threat landscape?

Hacking groups are expected to continue exploring new AI applications, such as automating attack phases and developing more sophisticated malware, requiring a proactive approach to cybersecurity.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the misuse of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.