Mexico, Brazil, Ecuador in CL-CRI-1131, 1163

Executive summary

Palo Alto Networks Unit 42 documented two intrusion clusters in Latin America, CL-CRI-1131 and CL-CRI-1163, that combined commercial language models with attacker-owned infrastructure, conventional phishing, iterative scripts, custom RATs and SOCKS5 tunneling. The first cluster hit a Mexican transportation company, Mexican federal ministries and water entities in Ecuador. The second targeted Brazil’s financial sector through job-themed phishing and résumé attachments.

The novelty was not an autonomous AI attack vector, but the operational use of commercial LLMs inside familiar campaigns. Unit 42, and the summaries citing its analysis, describe a self-hosted NextChat instance on 178.128.87[.]160, exposed on TCP port 3000, used to query services such as Claude and GPT-4.1. That interface appears to have supported troubleshooting, script generation and assistance with exfiltration and exploitation tasks. The material also says initial access still depended on phishing and unpatched servers.

In CL-CRI-1163, the most distinctive component was SockTz, a reverse SOCKS5 proxy written in Go. Unit 42 observed at least nine successive versions, with file names such as socktz_v1 through socktz_v9, deployed with incremental changes over an approximate two-hour window. Several secondary sources, including Machine Speed, SecurityLab, daily.dev and CISOclub, read that pace as a sign of AI-assisted debugging and binary generation, although that conclusion is inferred and not a formal attribution in the original report.

The CL-CRI-1131 campaign relied on living-off-the-land techniques and iterative batch scripts to manipulate and exfiltrate sensitive data. CL-CRI-1163, by contrast, used job-themed phishing, custom RATs and SOCKS5 tunnels for internal pivoting. Unit 42 and the briefings citing its findings stress that initial access still came from phishing and unpatched systems, not from AI-specific vulnerabilities. AI strengthened existing TTPs instead of introducing a new autonomous entry point.

The regional footprint is clear and limited. Mexico accounts for most of the CL-CRI-1131 activity, with victims in transportation, federal government and water. Ecuador appears as an extension of that same campaign, with at least one municipal water company and other reports broadening the water-sector exposure. Brazil is the center of CL-CRI-1163, with financial-sector victims, including banks, and an intrusion chain that involved repeated staging from compromised attacker-controlled infrastructure. The available material does not attribute these clusters to any specific country, nation-state or region.

Background and context

The consolidated material makes it possible to reconstruct a fairly precise technical sequence, though not authorship attribution. Unit 42 published a Portuguese-language report on September 3, 2026, about continued AI use in attacks against Latin American organizations, and several secondary sources reused that analysis in briefings, technical notes and summaries in different languages. The common thread is always the same, two clusters, two primary attack geographies and a shared operating pattern that mixes automation, LLMs and custom tooling.

The CL-CRI-1131 cluster is linked to compromises in Mexico and Ecuador. Available summaries cite a Mexican transportation company, multiple federal ministries and at least one municipal water company in Ecuador. In a later expansion, a Russian outlet also mentioned municipal water companies in Mexico, which broadens the inventory of water-infrastructure victims, although it does not change the overall picture. The campaign is built around living-off-the-land activity, iterative batch scripts and self-hosted NextChat used to query commercial models.

The CL-CRI-1163 cluster is concentrated in Brazil and the financial sector. Here, initial access reportedly came through job-themed phishing and résumé attachments, followed by deployment of custom RATs and SockTz. SockTz appears repeatedly in the reports because it enables reverse SOCKS5 connections and pivoting into the victim network. The most important detail is the iteration speed, v1 to v9, which several summaries place at under two hours.

Secondary reporting adds useful pieces. Machine Speed notes that the operators queried ChatGPT and Claude as work tools during the intrusions. SecurityLab reports working files such as exploit_creative.py, exploit_careful.py and rce_focused.py, suggesting a rapid generation and tuning process for code. CISOclub and daily.dev describe SockTz progressing from a compromised WordPress site to attacker-controlled infrastructure. SocDefenders adds domains and a specific binary associated with SockTz v9.

That set of sources does not change one central conclusion. The attackers do not appear to have needed an AI exploit to get in. They used phishing, attached artifacts, unpatched servers and conventional post-exploitation techniques. AI appears later, as an operational multiplier, not as the entry door.

Key facts table

Operation timeline

Attack chain and TTPs

The attack chain observed across both clusters follows a basic sequence, initial access through phishing or unpatched systems, execution of attached artifacts or scripts, use of commercial LLMs to speed up troubleshooting and tooling creation, and then persistence or pivoting through RATs and SOCKS5. The material shows no evidence of an AI exploit during the initial phase. AI appears as support for exploitation, code generation and rapid tool tuning.

CL-CRI-1131 relies more heavily on system techniques and scripts. The material says operators used living-off-the-land, ran iterative batch scripts and manipulated and exfiltrated sensitive data from compromised systems. That fits well with MITRE ATT&CK family T1059, and with evasion techniques associated with native tool abuse, although the original report does not label each step that way. The critical infrastructure layer was the self-hosted NextChat instance on 178.128.87[.]160.

CL-CRI-1163 has a clearer post-exploitation and pivoting component. Job-themed phishing and résumé attachments led to deployment of custom RATs and SockTz. SocDefenders, MITRE and other secondary sources make it possible to map T1566.001 to initial access, T1219 to RAT use, T1090.003 to multi-hop proxies and T1059 to scripts and commands. The fact that SockTz is a reverse SOCKS5 proxy in Go makes its technical function straightforward.

The most unusual piece is the tooling iteration. Unit 42 observed at least nine successive versions of SockTz, and several sources say socktz_v1 through socktz_v9 were deployed over a two-hour span. That pace does not prove AI assistance on its own, but it does suggest a rapid trial-and-error cycle, with minor changes and repeated redeployment. SecurityLab and daily.dev even describe exploit script names with varying adjectives, such as exploit_creative.py and exploit_careful.py, which strengthens the case for assisted generation.

In both clusters, the operation does not depend on an exotic technique but on the combination of several well-known pieces, phishing, LotL, scripts, RATs, proxies and LLMs. The value of the research is in showing that this combination is already active in the region and is being used with enough discipline to sustain complete intrusion chains.

Regional impact

Regional overview

The confirmed regional impact is concentrated in three countries, Mexico, Ecuador and Brazil, with clear differences between the transportation and government campaign in CL-CRI-1131 and the financial campaign in CL-CRI-1163. Mexico absorbs most of the public victims cited. Ecuador appears as an extension of the same operation, and Brazil as the focus of the second cluster, in a campaign aimed at banks and financial institutions.

The victim profile also changes by cluster. CL-CRI-1131 touches public infrastructure and critical services, transportation, federal government and water. CL-CRI-1163 targets a narrower financial vertical, but one that is technically more developed in post-exploitation, with custom RATs, tunneling and a SockTz version chain that suggests an accelerated refinement cycle. That distinction matters because it shows AI was not limited to generating text, but was used to sustain a multistage intrusion operation.

On the operational side, both clusters share infrastructure for interacting with commercial LLMs, especially self-hosted NextChat. That increases the value of that host as a critical asset in the attack chain. If that node is cut off, the operators lose access to Claude, GPT-4.1 and other services used for scripting and troubleshooting, although the material does not claim this is the only possible point of failure.

Mexico

Mexico accounts for most of the damage attributed to CL-CRI-1131. The Unit 42 report, and the summaries citing it, mention a Mexican transportation company, federal ministries and municipal water companies. That last layer matters because the Russian-language material expands the water exposure to Mexican entities in addition to Ecuadorian ones. The campaign relied on living-off-the-land activity, iterative batch scripts and a NextChat instance hosted by the attackers on 178.128.87[.]160.

The most important technical signal for Mexico is that the chat infrastructure was used to query commercial language models during the intrusion. Unit 42 and Machine Speed place ChatGPT, Claude and GPT-4.1 inside the operation as working tools. That turns NextChat into a coordination node, not a minor accessory. The use of batch scripts to manipulate and exfiltrate sensitive data also shows the objective was not only access, but systematic extraction.

Ecuador

Ecuador appears as an extension of CL-CRI-1131, and according to the consolidated material, at least one municipal water company was compromised there. Secondary sources also describe ministries, water and transportation inside a single regional cluster, suggesting a broader campaign than a single isolated target. The technical pattern does not change, living-off-the-land activity, iterative scripts, self-hosted NextChat and exploitation supported by LLMs.

The available documentation does not provide a complete inventory of Ecuadorian victims. It does, however, establish a critical surface, municipal water, that is enough to understand the operational interest. From a defense perspective, that means the campaign should be treated as an intrusion with potential impact on essential services, not as a routine corporate phishing incident.

Brazil

Brazil is the center of CL-CRI-1163 and the clearest part of the study for post-exploitation analysis. Initial access came through résumé-based or job-themed phishing, with an attachment that served as the malicious artifact. Custom RATs and SockTz, the reverse SOCKS5 proxy in Go, followed. Unit 42 and secondary sources agree that the cluster affected financial-sector entities, including banks.

The critical piece here is SockTz. CISOclub, daily.dev and Deniz.in describe an attempt to deploy socktz_v1 through socktz_v8 from a compromised WordPress site using certutil, and then moving to socktz_v9 from attacker-controlled infrastructure when earlier versions failed. That kind of operational feedback shows a highly iterative campaign. It also shows the hosting network was not stable, but adaptive.

United States

The United States does not appear as a victim country in the consolidated research, but it does appear as the publication, support and contact point. Unit 42, part of Palo Alto Networks, published the main material, and the Portuguese-language report includes a toll-free contact number for North America. Palo Alto Networks also published corporate posts about using OpenAI and Anthropic models for defenders, a useful contrast to the offensive abuse of LLMs seen in these clusters.

That does not add a U.S. victim, but it does help place the response capability and vendor ecosystem. In the material, the United States functions as an editorial and support center, not as a target of CL-CRI-1131 or CL-CRI-1163.

Countries with no additional verifiable facts in the research for this section, Argentina, Chile, Paraguay, Bolivia, Peru, Colombia and Uruguay.

Technical indicators