AI-Assisted Campaigns Target Transportation and Financial Organizations in Latin America
Summary
Unit 42 analyzed two campaigns targeting organizations in Mexico, Ecuador and Brazil, finding phishing, custom tools and evidence of LLM use. Exposed staging infrastructure revealed scripts and operational details.
Key points
- The Mexican-focused CL-CRI-1131 campaign used living-off-the-land techniques and iterative batch scripts to collect and exfiltrate sensitive data.
- Targets associated with CL-CRI-1131 included a transportation organization, government ministries and municipal water utilities in Mexico and Ecuador.
- Researchers found a publicly exposed NextChat instance on campaign infrastructure and assessed that attackers used LLMs to troubleshoot and generate workaround scripts.
- The Brazilian-focused CL-CRI-1163 campaign likely gained access through a resume-themed phishing attachment targeting the financial sector.
- CL-CRI-1163 used custom RATs and attempted multiple versions of SockTz, a Go-based SOCKS5 tunneling tool.
- Exposed staging directories, iterative script names and infrastructure details—including certificates and overlapping proxy infrastructure—helped researchers track the campaigns.
- Palo Alto Networks says its WildFire, URL and DNS filtering, Cortex XDR and XSIAM products have protections for the activity.
Article Details
- Attack Vectors
- CL-CRI-1131 operators used numbered batch scripts and volume shadow copies to collect sensitive data, including the SAM registry hive and NTDS.dit, and attempted to exfiltrate data.
- CL-CRI-1163 operators gained initial access through a resume-themed phishing email attachment.
- CL-CRI-1163 operators attempted to install SockTz versions 1–8 from a compromised WordPress site, then retrieved version 9 from attacker-controlled infrastructure.
- The campaigns used SOCKS5 proxying and tunneling, custom RATs, and exposed staging infrastructure hosting campaign scripts.
- Defensive Notes
- The article recommends Palo Alto Networks Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR, and XSIAM for protection.
- The researchers identify exposed staging directories, unsecured NextChat interfaces, and operational security failures as opportunities for defenders to track and disrupt the campaigns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | m-doxa-apodo[.]duckdns[.]org | Campaign infrastructure associated with CL-CRI-1131. |
| DOMAIN | m-doxa-geo[.]duckdns[.]org | Campaign infrastructure associated with CL-CRI-1131. |
| DOMAIN | m-doxa-intel[.]duckdns[.]org | Campaign infrastructure associated with CL-CRI-1131. |
| DOMAIN | m-doxa-repuve[.]duckdns[.]org | Campaign infrastructure associated with CL-CRI-1131. |
| DOMAIN | m-doxa-sre[.]duckdns[.]org | Campaign infrastructure associated with CL-CRI-1131. |
| DOMAIN | m-doxa-vacunas[.]duckdns[.]org | Campaign infrastructure associated with CL-CRI-1131. |
| IPV4 | 165[.]22[.]184[.]26 | Host associated with a certificate used in CL-CRI-1131 infrastructure. |
| IPV4 | 167[.]148[.]195[.]53 | CL-CRI-1163 attacker-associated open directory hosting SockTz installers and campaign scripts. |
| IPV4 | 178[.]128[.]87[.]160 | CL-CRI-1131 infrastructure hosting an attacker-used NextChat instance. |
| IPV4 | 62[.]171[.]185[.]97 | Infrastructure used for data exfiltration in CL-CRI-1131. |
| SHA256 | 46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c | SHA-256 fingerprint of a certificate associated with CL-CRI-1131 infrastructure. |
| SHA256 | 4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5 | SHA-256 fingerprint of a certificate associated with CL-CRI-1131 infrastructure. |
| SHA256 | 7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8 | SHA-256 fingerprint of a certificate associated with CL-CRI-1131 infrastructure. |
| SHA256 | 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec | SHA-256 hash listed as an indicator for the Brazilian financial campaign. |
| SHA256 | a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 | SHA-256 hash listed as an indicator for the Brazilian financial campaign. |
| URL | hxxp[:]//167[.]148[.]195[.]53:8888/socktz_v9.exe | Attacker-controlled URL used to retrieve SockTz version 9. |
MITRE ATT&CK
T1003.002 · Security Account ManagerOperators attempted to dump the SAM registry hive from a compromised host.T1003.003 · NTDSOperators attempted to obtain the domain controller NTDS.dit file.T1041 · Exfiltration Over C2 ChannelCL-CRI-1131 used 62.171.185[.]97 for data exfiltration.T1059.003 · Windows Command ShellCL-CRI-1131 operators used numbered batch scripts to collect data and troubleshoot operations.T1566.001 · Spearphishing AttachmentCL-CRI-1163 initial access involved a resume-themed phishing email attachment.
Threat Actors
Malware
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS SecurityAdvanced URL FilteringAdvanced URL Filtering and Advanced DNS SecurityAdvanced WildFireAdvanced WildFireClaudeThese reports describe attackers using multiple LLMs, including Claude and GPT-4.1 to troubleshoot issues faced by the attackers across their campaigns.Cortex XDRCortex XDR and XSIAMGPT-4.1These reports describe attackers using multiple LLMs, including Claude and GPT-4.1 to troubleshoot issues faced by the attackers across their campaigns.NextChatThey executed iterative batch scripts to manipulate and exfiltrate sensitive data, and self-hosted NextChat instances on operational infrastructure.WordPressWe observed attempts to install versions 1–8 of a Go-based reverse SOCKS5 tunneling tool named SockTz from a compromised WordPress site.XSIAMCortex XDR and XSIAM
Countries
BrazilEcuadorMexican transportation campaign: This campaign impacted a transportation organization, alongside federal government ministries and municipal water utilities in Mexico and Ecuador.MexicoMexican transportation campaign: This campaign impacted a transportation organization, alongside federal government ministries and municipal water utilities in Mexico and Ecuador.
Industries
Financial ServicesGovernmentMexican transportation campaign: This campaign impacted a transportation organization, alongside federal government ministries and municipal water utilities in Mexico and Ecuador.TransportationMexican transportation campaign: This campaign impacted a transportation organization, alongside federal government ministries and municipal water utilities in Mexico and Ecuador.Water utilitiesMexican transportation campaign: This campaign impacted a transportation organization, alongside federal government ministries and municipal water utilities in Mexico and Ecuador.