2026-09-04 · view entry permalink →
Unit 42 exposes two Latin American intrusion clusters after their own AI-agent staging infrastructure was left open, one hit Mexican federal ministries and water utilities, the other Brazilian finance
Unit 42 published two distinct, ongoing intrusion clusters against Latin American targets on 2026-09-03, both showing operators using commercial LLMs to drive parts of the attack chain. CL-CRI-1131 hit a Mexican transportation organization plus federal government ministries and municipal water utilities in Mexico and Ecuador: operators relied on living-off-the-land batch scripts, and (after repeated failed attempts to dump the SAM registry hive and NTDS.dit) pivoted to shadow-copy-based collection instead (Unit 42, 2026-09-03). A self-hosted instance of NextChat, an open-source multi-model LLM chat interface, exposed on the operators' own infrastructure is what let Unit 42 reconstruct the operators' targeting logic: given the initial collection failures and the exposed AI interface on the same backend, Unit 42 assesses the operators relied on the LLM to generate the working-around scripts. Certificate-transparency pivoting on the associated infrastructure showed a single-domain certificate in February 2026 rotating to a five-subdomain certificate by April/June 2026, with subdomain names indicating Mexican federal-government targeting categories. Unit 42 ties this activity to the campaign CloudSEK separately tracks as "Operation Escaneo."
CL-CRI-1163 is a separate cluster reached via job-themed phishing against the Brazilian financial sector, deploying homebrewed malware rather than living-off-the-land tooling: within a two-hour window, attackers attempted installation of versions 1 through 8 of a Go-based reverse SOCKS5 tunneling tool named SockTz from a compromised WordPress site, then, after that install path failed, retrieved a ninth version from separate attacker-controlled infrastructure, with exploit-script filenames appended with descriptive adjectives (exploit_creative.py, exploit_careful.py, rce_focused.py) that Unit 42 reads as evidence of iterative, language-model-driven script generation rather than human authorship. Unit 42's central finding across both clusters is that the operators' own AI-staging infrastructure (an open NextChat directory, an open directory of numbered SockTz builds) is what let researchers reconstruct the operators' playbooks: attacker OpSec failures around their own AI tooling, not the AI use itself, are the exploitable defender advantage.
Separately, on 2026-09-01, Google Threat Intelligence Group/Mandiant documented BREEZE COMET (formerly UNC5669), a financially-motivated actor active against Brazilian financial services, retail and eCommerce since 2024, which GTIG states overlaps with activity publicly reported by others as "Plump Spider" and "SHADOW-AETHER-064" (Google Threat Intelligence Group / Mandiant, 2026-09-01). Trend Micro has reported that the group also exploits vulnerabilities in JBoss AS servers for initial access (Google Threat Intelligence Group / Mandiant, 2026-09-01, citing Trend Micro), alongside password spraying and voice-phishing calls impersonating IT support to talk targets into installing remote-monitoring tools. BREEZE COMET manipulates Brazil's Pix, STR and Boleto payment rails via a custom malware suite and stages through compromised small-government websites across Brazil, Nigeria, Paraguay, Ghana and Venezuela; one component, MILDFROST, is a passive Java backdoor that uses a class named DnsCommandBeacon to run a slow, covert DNS tunnel as a fallback command channel, dynamically querying delegated subdomains for instructions and fresh payloads (Google Threat Intelligence Group / Mandiant, 2026-09-01). GTIG independently confirms LLM-generated reconnaissance, credential-validation and deployment scripts in this cluster too, identified by a verbose AI-generated commenting style rather than any hardcoded signature. Within 24 to 48 hours of gaining access to core financial applications, GTIG reports the actor executed two waves of hundreds of fraudulent transactions.
we observed the attacker struggling to gather sensitive data. After repeated attempts to dump the Security Account Manager (SAM) registry hive and the domain controller NTDS.dit file, the attacker created shadow copies across multiple drives
Exposing an open NextChat directory to the public internet reveals a fundamental lack of operational maturity. The AI provided the necessary tactical workaround to extract the Active Directory database, but the human operators failed to secure the staging server.
attackers appended exploit filenames with descriptive adjectives. This suggests that the attackers employed iterative, language model-driven development: exploit_creative.py, exploit_careful.py and rce_focused.py.
Within 24-48 hours of establishing this access, the threat actor executed two waves of hundreds of fraudulent transactions, based on reporting by a client and third party forensic analysis.