Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

This threat involves two distinct multi-stage intrusion campaigns targeting Latin American organizations. The Mexican campaign (CL-CRI-1131) impacted transportation and government entities in Mexico and Ecuador, employing living-off-the-land tactics and self-hosted NextChat instances. The Brazilian campaign (CL-CRI-1163) targeted financial organizations using custom RATs and tunneling tools, including a Go-based SOCKS5 proxy. Both operations share technical overlaps such as shared SOCKS5 infrastructure and reliance on commercial large language models like Claude and GPT-4.1 for operational orchestration, including script generation and troubleshooting. Attackers' operational security failures, such as exposed staging directories and unsecured NextChat interfaces, have allowed defenders clear visibility into their activities. Indicators include multiple domains under duckdns.org, IP 167.148.195.53, and various file hashes. No known exploits in the wild or confirmed active threat actors are specified.

The campaigns enable attackers to maintain persistent access and control over targeted organizations' networks in Latin America, potentially leading to data exfiltration, espionage, or disruption of operations. The use of AI tools enhances attackers' capabilities to automate and troubleshoot their operations, increasing their efficiency. However, operational security lapses have reduced attackers' stealth, providing defenders with opportunities for detection and response. There are no known exploits in the wild or confirmed active threat actors at this time.

No official patches or fixes are applicable as this is an active intrusion campaign rather than a software vulnerability. Defenders should leverage the exposed operational security failures to detect and disrupt attacker infrastructure, such as monitoring for the listed domains and IP addresses, and securing any exposed staging directories or interfaces like NextChat. Incident response should focus on identifying and removing custom RATs and tunneling tools. Employing threat intelligence feeds containing the provided indicators can aid in detection. There is no vendor-managed remediation since this is not a cloud service or software vulnerability.