Mexico, Brazil Face AI-Linked Intrusions

Update September 13, 2026: The Hacker News added a new alias for CL-CRI-1163, Breeze Comet, also referred to as Plump Spider and SHADOW-AETHER-064. The coverage reinforces that the campaign in Brazil targets the financial sector and seeks to abuse payment infrastructure to carry out illegal transactions for profit.

Palo Alto Networks Unit 42 reported two active campaigns targeting organizations in Latin America. One aimed at the transportation sector in Mexico and also reached Mexican federal ministries and municipal water services in Mexico and Ecuador. The other focused on Brazil’s financial sector. In parallel, other intelligence reports described ransomware activity in the region, with Mexico among the most affected countries.

What did Unit 42 detect in Mexico and Brazil?

Unit 42 observed previously reported vulnerable web servers, job-themed phishing, custom remote access tools, and a Go-based SOCKS5 proxy with iterative file names. It also documented initial access through a resume-themed phishing attachment in February 2026. The activity was attributed to the CL-CRI-1163 cluster, although the available summary did not present it as a definitive attribution to any specific ransomware family.

The official September 3, 2026 update clarified that CL-CRI-1131, in Mexico and Ecuador, is a data exfiltration intrusion with AI used as operational support, not a ransomware attack. In that campaign, operators repeatedly tried to extract SAM and NTDS.dit, then turned to volume shadow copies and batch scripts rewritten iteratively during the intrusion.

Cloud Security Alliance expanded on that assessment and identified two separate but tactically overlapping clusters, CL-CRI-1131 and CL-CRI-1163. According to that technical note, the first affected transportation in Mexico, Mexican federal ministries, and a municipal water company in Ecuador, while the second centered on Brazil’s financial sector using resume lures. CSA Labs added that both clusters used commercial large language models as operational support during the intrusions.

Machine Speed also said CL-CRI-1131 and CL-CRI-1163 used commercial language models within their attack chain. That effort likewise placed the campaigns against transportation organizations, federal ministries, and water services in Mexico and Ecuador, along with financial entities in Brazil. CSA recommended that government, transportation, water, and financial organizations in those countries review indicators of compromise such as C2 domains, IP addresses, and file hashes published by Unit 42 against their own telemetry.

Later technical coverage added that the operators used a self-hosted NextChat instance connected to Claude and GPT-4.1, and that AI-generated scripts were exposed in the adversary’s own infrastructure. It also described a trial-and-error pattern, with successive rewrites of commands until a workable snapshot-based copy method was achieved.

Grid the Grey added that both campaigns shared SOCKS5 relays and that the attackers used commercial LLMs together with self-deployed NextChat instances to plan and orchestrate attack phases. That analysis placed CL-CRI-1131 in Mexico and Ecuador, with a focus on transportation and government, and CL-CRI-1163 in Brazil, with a focus on the financial sector.

The Hacker News now added that CL-CRI-1163 is also known in the community as Breeze Comet, Plump Spider and SHADOW-AETHER-064. The publication describes it as a cybercrime group that infiltrates Brazilian financial systems to abuse payment infrastructure and carry out illegal transactions for profit.

What do the other ransomware reports show in the region?

The rest of the reporting points to a broader regional market with multiple active actors. Insomnia reported a campaign attributed with high confidence to BlackCat/ALPHV, with victims in 22 countries and techniques including spearphishing, exploitation of exposed infrastructure, use of valid accounts, cloud storage exfiltration, data encryption and external defacement.

That analysis also said the campaigns observed against BlackCat/ALPHV affected health care, energy, manufacturing, legal and SaaS. Initial access varied between spearphishing, exploitation of unpatched perimeter appliances and valid credentials bought or stolen.

Regionally, El Economista cited a SCILabs report that recorded 290 ransomware attacks between January and June 2026 in Latin America, tied to 50 different variants. The same report said incidents rose 25.5% from the previous period and that Mexico accounted for 17.93% of regional activity, about 52 cases, behind Brazil.

SCILabs also broke down sector exposure, with services accounting for 19.66% of incidents, about 57 cases, followed by government at 11.72% and manufacturing at 8.28%. Among variants, [The Gentlemen](/en/news/argentina-gentlemen-s-sights) was the most active in Latin America with at least 49 attacks, ahead of Qilin with 46 and LockBit 5.0 with 43.

BlackFog added a local government case involving a ransomware incident against the municipality of San Luis Potosí, Mexico, where employee information was confirmed to have been exfiltrated before an extortion attempt. On another front, Acronis identified The Gentlemen as the most active group in July 2026 with 162 known victims, followed by Qilin with 128, a jump from June.

An emerging actor also appeared. Darkfield documented Vexy Ransomware and recorded Engefitas, a Brazilian company linked to industrial sectors, as a victim under the energy and utilities vertical. The profile said Vexy had added eight public victims between September 3 and 6, 2026, and that its focus on energy and utilities in Brazil warrants monitoring because of the implications for critical infrastructure.