AI-enhanced cyberattacks target organizations in Latin America

Two distinct cyberattack campaigns targeting organizations in Latin America have been identified, showing an increasing reliance on artificial intelligence to enhance intrusion and data exfiltration capabilities.

The first campaign, identified as CL-CRI-1131, has targeted a transportation organization, federal government ministries, and municipal water utilities in Mexico and Ecuador. These attackers utilized living-off-the-land techniques and self-hosted NextChat instances to manipulate and exfiltrate sensitive data.

The second campaign, CL-CRI-1163, focuses on the Brazilian financial sector. This activity involves job-themed phishing campaigns targeting vulnerable web servers, utilizing custom remote access Trojans and Go-based SOCKS5 proxies.

While these clusters represent separate geographic focuses, they share technical overlaps, including the use of similar SOCKS5 relay infrastructure. Both groups appear to use commercial large language models (LLMs) to orchestrate their operations, signaling a shift in the regional threat landscape toward AI-integrated cybercrime.