A crew breaking into government ministries and a transport company in Mexico ran its AI assistant on the same server it used for the attacks, and left that server open to the internet. Researchers at Palo Alto Networks' Unit 42 say the exposed setup, together with a second crew's browsable script folder in Brazil, gave them an unusually clear view of how two Latin American operations are using commercial AI models to get past the parts of an intrusion they could not manage on their own.
It matters because it shows what AI-assisted crime looks like from the inside: not autonomous attacks, but operators repeatedly asking a chatbot to fix scripts that keep failing, then forgetting to lock the door on the chatbot.
Two clusters, one habit
Unit 42 tracks the activity as two clusters. CL-CRI-1131 hit a transportation organization along with federal government ministries and municipal water utilities in Mexico and Ecuador, relying on built-in Windows tools rather than custom malware. CL-CRI-1163 targeted the Brazilian financial sector with homebrewed remote access trojans and tunneling tools after a job-themed phishing email. The two share SOCKS5 relay infrastructure, and both lean on commercial large language models to run their operations.
Scripts that failed until the chatbot fixed them
During an April 2026 intrusion in the Mexican cluster, the attacker tried repeatedly to copy the Security Account Manager registry hive and the domain controller's NTDS.dit file, which hold local and domain password hashes. After those attempts failed, the operator created volume shadow copies across several drives and copied the files from there, while running a series of numbered batch scripts that had been patched with a permissions check. Unit 42 says that trial-and-error pattern is consistent with an operator working through an LLM.
The proof came from the infrastructure. Pivoting on the exfiltration address 62.171.185[.]97, the researchers found a Let's Encrypt certificate for m-doxa-apodo.duckdns[.]org, then a multi-name certificate covering five active subdomains whose labels hint at intended Mexican federal targets. The host behind two of those certificates, 178.128.87[.]160, was running NextChat, an open-source web front end for querying multiple AI models, on port 3000. Unit 42 assesses the attackers relied on LLMs reached through that interface to generate the workaround scripts.
The Mexican activity is the campaign CloudSEK reported as Operation Escaneo, and a Gambit report on its February 2026 phase described the operators using Claude and GPT-4.1 to troubleshoot. IntelFusions covered the exposed staging server that first revealed the Mexican campaign in June.
exploit_creative.py, exploit_careful.py, rce_focused.py
The Brazilian cluster told the same story in file names. After a resume-themed phishing attachment in February 2026 and several failed RAT installs, the attackers tried to fetch versions 1 through 8 of SockTz, a Go-based reverse SOCKS5 tunneling tool, from a compromised WordPress site, then pulled version 9 from their own server at 167.148.195[.]53. All nine attempts landed inside a two-hour window. That server hosted an open directory with hundreds of campaign scripts, many suffixed _output and several carrying the adjectives above, which Unit 42 reads as iterative, model-driven development.
Hunt the AI backend, not the malware
Unit 42's conclusion is that AI made these crews more capable and less careful at the same time. The model produced the workaround that extracted an Active Directory database; the humans left the prompt history, playbook and staging scripts on a public server. Defenders can pivot on exactly those mistakes: certificate naming patterns on duckdns[.]org, NextChat instances on operational infrastructure, and open directories full of numbered scripts. Organizations in Mexico and Brazil should check for the indicators below.
The report is by Reese Lewis and Sara McBroom; the original Unit 42 research carries the full timeline, figures and indicators.
Indicators (defanged): Mexico cluster domains m-doxa-apodo.duckdns[.]org, m-doxa-geo.duckdns[.]org, m-doxa-intel.duckdns[.]org, m-doxa-repuve.duckdns[.]org, m-doxa-sre.duckdns[.]org, m-doxa-vacunas.duckdns[.]org; hosts 62.171.185[.]97, 165.22.184[.]26, 178.128.87[.]160. Brazil cluster: 167.148.195[.]53, download URL hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe, SHA-256 a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996 and 87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.