Affected Systems

Organizations in Latin America, specifically: Mexican transportation, federal government ministries, municipal water utilities (Mexico/Ecuador) in CL-CRI-1131; Brazilian financial sector in CL-CRI-1163. Campaign active February–June 2026.

Exploitation Status

Active exploitation confirmed. Attackers observed using LLM-assisted scripting (ChatGPT, Claude, NextChat) for iterative data collection, credential dumping (SAM, NTDS.dit), and custom Go-based SOCKS5 proxies. Operational infrastructure exposed via OPSEC failures (Let's Encrypt certificates, DuckDNS domains).

Business Impact

Threat actors are successfully exfiltrating sensitive data from government and critical infrastructure targets using AI-enhanced tooling. Living-off-the-land techniques and custom RATs complicate detection. Shared SOCKS5 relay infrastructure between campaigns indicates coordinated or copycat activity. Defenders can leverage exposed attacker infrastructure (certificates, domains, IPs) for proactive blocking and threat hunting.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Block known malicious infrastructure: IPs 62.171.185[.]97, 165.22.184[.]26, 178.128.87[.]160; domains m-doxa-apodo.duckdns[.]org, m-doxa-geo.duckdns[.]org, m-doxa-intel.duckdns[.]org, m-doxa-vacunas.duckdns[.]org
  • Hunt for volume shadow copy manipulation (vssadmin, wmic shadowcopy) and SAM/NTDS.dit extraction attempts in Windows event logs and EDR telemetry
  • Monitor for numbered batch script execution patterns (e.g., 1.bat, 2.bat) and outbound SOCKS5 proxy traffic, especially Go-based tools with iterative filenames
  • Review Advanced URL Filtering and DNS Security logs for DuckDNS dynamic DNS usage and Let's Encrypt certificate anomalies tied to operational infrastructure
  • Conduct threat hunting for self-hosted NextChat or similar LLM interface deployments on internal networks, especially in DMZ or operational segments

---

# Geopolitical Context

Geopolitical Context

Two distinct but technically overlapping intrusion campaigns—CL-CRI-1131 and CL-CRI-1163—have targeted organizations across Mexico, Ecuador, and Brazil since early 2026. The campaigns appear to represent a regional evolution in threat actor tradecraft, with operators leveraging commercial large language models (LLMs) such as ChatGPT and Claude to streamline data exfiltration operations. CL-CRI-1131 focused on Mexican transportation infrastructure, federal government ministries, municipal water utilities, and entities in Ecuador, while CL-CRI-1163 targeted Brazil's financial sector through job-themed phishing and exploitation of vulnerable web servers. Infrastructure analysis reveals shared SOCKS5 relay networks and iterative, trial-and-error scripting consistent with AI-assisted tooling. The campaigns reflect broader trends in Latin America's cyber threat landscape: adversaries with varying capabilities are independently adopting advanced proxy infrastructure and AI integration to enhance operational tempo and reduce technical barriers. The exposure of operational security errors—including misconfigured TLS certificates and exposed dynamic DNS naming conventions—enabled defenders to map attacker infrastructure and disrupt ongoing activity. The targeting of critical sectors (transportation, water utilities, finance) and government entities suggests espionage or financially motivated objectives, though no definitive attribution to state or non-state actors has been established.

State Actor Alignment

No state actor attribution is provided in the available data. The campaigns are tracked as distinct activity clusters (CL-CRI-1131 and CL-CRI-1163) without linkage to known advanced persistent threat (APT) groups or nation-state sponsors. The targeting of government ministries, critical infrastructure, and financial institutions is consistent with both state-sponsored espionage and organized cybercrime, but operational security failures and reliance on commercial AI tools may suggest less sophisticated, regionally focused threat actors rather than well-resourced state intelligence services. The use of dynamic DNS providers (DuckDNS) and Let's Encrypt certificates, alongside trial-and-error scripting, indicates adversaries operating with moderate technical proficiency and limited operational security discipline. No sanctions, policy responses, or formal government statements regarding these campaigns have been reported.

Business Impacty pro region

The campaigns underscore Latin America's growing exposure to cyber threats that blend traditional criminal tactics with emerging AI-enabled capabilities. For Mexico, the targeting of federal ministries, municipal water utilities, and transportation infrastructure highlights vulnerabilities in critical national systems and raises concerns about potential disruption to public services and national security. Ecuador's inclusion in CL-CRI-1131 targeting suggests cross-border coordination or opportunistic expansion by threat actors exploiting regional connectivity and shared language. Brazil's financial sector targeting through CL-CRI-1163 aligns with the country's status as Latin America's largest economy and a persistent target for financially motivated cybercrime. The adoption of AI tools by regionally focused adversaries may lower barriers to entry for less sophisticated actors, potentially increasing the volume and complexity of intrusions across Latin America. For global stakeholders, these campaigns illustrate how AI democratization is reshaping threat landscapes in emerging markets, where defensive capabilities may lag behind adversary innovation. European and North American organizations with operations or partnerships in Latin America should reassess third-party risk and supply chain exposure, particularly in transportation, utilities, and financial services sectors.

Forecast

If threat actors continue to refine AI-assisted tradecraft and improve operational security, the frequency and sophistication of intrusions targeting Latin American critical infrastructure and financial institutions are likely to increase over the coming months. Should defenders successfully disrupt shared SOCKS5 infrastructure and dynamic DNS networks, operators may migrate to more resilient command-and-control (C2) architectures, complicating attribution and response efforts. If regional governments enhance public-private threat intelligence sharing and invest in detection capabilities for AI-generated malware and scripting, the operational lifespan of campaigns like CL-CRI-1131 and CL-CRI-1163 may be reduced. However, if adversaries successfully monetize exfiltrated data or achieve strategic intelligence objectives, copycat campaigns leveraging similar AI-enabled techniques are likely to proliferate across Latin America and other regions with comparable cyber maturity levels. The exposure of operational security errors in these campaigns may prompt threat actors to adopt more disciplined infrastructure management, reducing defender visibility into future operations.