Mexico, Brazil campaigns hit by Unit 42

Update September 9, 2026: New details were added on Gambling Goblin’s campaign in Brazil, including victims identified by SecurityLab LATAM and more precision on the use of Apache servers as a proxy. It was also reinforced that the network of compromised .gov.br sites is sustaining global SEO manipulation.

Unit 42 reported two active campaigns against organizations in Latin America. One targeted transportation, federal ministries, and municipal water services in Mexico and Ecuador. The other focused on Brazil’s financial sector. At the same time, other coverage described Blind Eagle activity in Colombia and Gambling Goblin against Brazilian public websites.

What did Unit 42 detect in Mexico, Ecuador, and Brazil?

Unit 42 identified a transportation campaign in Mexico, with additional impact on Mexican federal ministries and a municipal water company in Ecuador, as well as a financial campaign in Brazil. Internally, the firm attributed the first to cluster CL-CRI-1131 and the second to CL-CRI-1163.

In the case of CL-CRI-1131, Unit 42 described the use of living-off-the-land techniques, batch scripts to manipulate and exfiltrate data, and NextChat hosted on the attackers’ operational infrastructure. CSA expanded that coverage and said the target set is not limited to one industry vertical, but spans critical infrastructure and public administration.

For CL-CRI-1163, Unit 42 pointed to custom RATs and tunneling tools, including a Go-based SOCKS5 proxy. The same coverage said that in February 2026 the attackers gained initial access through a CV attachment in a phishing email. CSA added that the SOCKS5 proxy was versioned and redeployed in at least nine iterations, suggesting active tooling maintenance and a prolonged campaign against Brazil’s financial sector.

How did the CL-CRI-1131 and CL-CRI-1163 clusters operate?

The two clusters show sustained use of common system tools, iterative scripts, and custom components for persistence, exfiltration, and communication tunnels. CSA also said both operators consistently used their own NextChat interfaces to query commercial LLMs such as Claude and GPT-4.1, for operational purposes that included exploit troubleshooting and iterative generation of exfiltration scripts.

SocDefenders.ai also described CL-CRI-1131 and CL-CRI-1163 as active campaigns since at least February 2026, and highlighted the mix of LotL, batch scripting, and custom malware, including the Go SOCKS5 proxy used for traffic tunneling. Risky Business, in its newsletter, summarized the Mexican campaign as active activity that affected a transportation organization, federal ministries, and municipal water services in Mexico and Ecuador.

SocDefenders.ai added new indicators of compromise for CL-CRI-1131, including the domains m-doxa-apodo.duckdns.org, m-doxa-geo.duckdns.org, and m-doxa-intel.duckdns.org, the URL hxxp://167.148.195[.]53:8888/socktz_v9.exe, and several SHA-256 hashes of malicious binaries tied to the SOCKS5 proxy.

What happened with Blind Eagle in Colombia?

LevelBlue SpiderLabs published analysis of a malicious loader infrastructure linked to Blind Eagle, also known as APT-C-36, in Colombia. The coverage referred to judicial notice lures and targeting of Colombian government entities.

Security Arsenal and OffSeq Threat Radar added that the actor distributed loaders and RAT payloads through GitHub, using AsyncRAT, DcRat, Remcos, and XWorm. OffSeq detailed phishing emails with judicial notice and traffic fine lures, along with password-protected compressed files. DeafNews added that the GitHub account "cabeto850128" and the repositories "comicsam" and "jacobo" were used as staging for AutoIt loaders, while a local folder called "Rats" contained builds from those same families.

How did Gambling Goblin use Brazilian sites?

Check Point Research reported that Gambling Goblin, a Chinese-speaking group tied to the Earth Berberoka cluster, turned compromised government and education sites in Brazil into infrastructure for a sustained SEO fraud campaign starting in mid-2025. The coverage said the group inserted malicious modules into Apache servers belonging to government and educational organizations, and redirected legitimate traffic to betting and phishing pages while keeping browsing under the same domain.

SecurityLab LATAM reported that Gambling Goblin compromised servers at Brazilian agencies and educational institutions, with victims including a federal ministry, a state agency, a legislative assembly, oversight bodies, municipalities, and a public utility company. Coverage from The Arabian Post, Check Point Research, and CISOai added that the group installs malicious modules on Apache servers on Brazilian government and education sites to act as a proxy, keep the legitimate .gov.br URL visible, and selectively redirect users and crawlers to betting and phishing pages.

Infosecurity Magazine said the compromised organizations included federal, state, and municipal agencies, as well as a national public agency, a state legislative assembly, audit courts, and a state-owned utility company. A Check Point statement in Japan added that the phishing pages impersonate app stores such as Google Play, Microsoft Store, and Amazon, with versions in Brazilian Portuguese, Vietnamese, Spanish, and English. Nivel4 said the campaign has been active since mid-2025, aims to hijack traffic and manipulate search rankings at scale, and uses redirect chains across compromised domains, many of them government sites.

Check Point Research also stressed that Gambling Goblin’s SEO manipulation is sustained and global. According to that coverage, the compromised Brazilian sites act as core infrastructure in a proxy network that benefits betting and phishing campaigns aimed at users outside Brazil, taking advantage of the international reputation of .gov.br domains.