- The Mess: Attackers targeting organizations in Mexico and Brazil are using commercial LLMs to troubleshoot intrusions, generate scripts and keep their operations moving. Unit 42 found the AI infrastructure exposed online — and that mistake gave researchers a look inside the attackers’ workflow.
Two separate campaigns were tracked under CL-CRI-1131 and CL-CRI-1163.
The first targeted transportation, government and municipal water organizations in Mexico and Ecuador. The second hit Brazil’s financial sector through job-themed phishing and compromised web infrastructure.
Different targets.
Different tooling.
Same idea: use AI when the attack gets stuck.
In the Mexican campaign, attackers repeatedly failed while trying to extract sensitive Windows data, including the SAM registry hive and the domain controller’s NTDS.dit.
Instead of manually debugging everything, they iterated through numbered batch scripts.
Unit 42 says the repeated trial-and-error behavior is consistent with attackers using commercial LLMs to troubleshoot their operations and generate workarounds.
The attackers eventually used Volume Shadow Copy operations to access and copy data.
Then researchers found something even more interesting.
The attackers had deployed NextChat, an open-source interface for interacting with multiple LLMs, on their own infrastructure.
That exposed a potential backend for their AI-assisted operations.
Unit 42 linked the infrastructure to previous activity involving models including Claude and GPT-4.1.
The attackers weren’t asking an AI to write a ransomware note.
They were using it like a remote technical consultant.
Need a script fixed?
Ask the model.
Data extraction failing?
Ask the model.
Proxy configuration broken?
Ask the model.
Keep going.
- The Damage: AI lowers the technical barrier for attackers and lets smaller or less experienced crews recover from mistakes that previously could have stopped an intrusion.
The Brazilian campaign shows the same pattern from another angle.
Attackers used a custom RAT and a Go-based SOCKS5 tunneling tool called SockTz.
They attempted versions socktz_v1 through socktz_v9 in a short period after earlier attempts failed.
The infrastructure also exposed hundreds of scripts.
Some filenames were almost comically revealing:
exploit_creative.py
exploit_careful.py
rce_focused.py
That naming pattern, combined with the repeated iterations, gave Unit 42 additional evidence that LLMs were being used during development and troubleshooting.
The attackers were effectively running an AI-assisted development loop inside an active intrusion.
And there was another common component.
Both campaigns used overlapping SOCKS5 relay infrastructure.
That gave researchers a way to connect activity that initially looked unrelated.
The irony is that AI wasn’t what exposed the attackers.
Bad OpSec was.
The Mexican operation left an attacker-controlled NextChat deployment exposed.
The Brazilian operation left an open directory containing tools and scripts.
The same technology that helped the attackers move faster also generated enough operational noise for researchers to follow the trail.
That’s an important distinction.
AI didn’t magically make these attacks autonomous.
Human operators still chose the targets, deployed infrastructure, handled access and made operational decisions.
The LLM acted more like a force multiplier.
And that may be the more realistic threat model.
Attackers don’t need an autonomous cyber agent that owns an entire network.
They can simply use AI to remove the annoying parts of an intrusion.
- The Fix: Defenders should hunt for unusual LLM infrastructure, exposed attacker tooling, suspicious SOCKS5 relays, repeated script variants and abnormal command execution rather than waiting for an obvious AI-generated payload.
For organizations, the defensive lesson is straightforward.
Monitor outbound connections to unknown proxy infrastructure.
Investigate unexpected SOCKS5 activity.
Watch for suspicious PowerShell, batch-script and certutil execution.
Treat compromised WordPress sites as potential malware infrastructure, not merely defaced websites.
And don’t assume that a technically messy attacker is harmless.
AI can compensate for the mess.
Unit 42’s findings show attackers repeatedly recovering from failed execution attempts with LLM-assisted troubleshooting.
The other side of the equation is equally interesting.
The exposed NextChat instance, certificates and open directories became intelligence goldmines.
Attackers are adopting AI faster than they’re adopting basic operational security.
For defenders, that creates a new hunting opportunity.
Bugstoday Opinion
The hype around AI-powered hacking usually focuses on some mythical autonomous cyber monster.
This is more interesting.
The attacker gets stuck.
They ask an LLM.
The script gets rewritten.
They try again.
It fails.
They ask again.
Eventually the intrusion works.
That’s enough.
You don’t need Skynet to break into a company.
You need an attacker who can troubleshoot faster than the defender can detect them.
And now that troubleshooting can be outsourced to a machine.
The funniest part?
The attackers in these campaigns used AI to become better operators — then left their AI infrastructure sitting on the public internet.
The machine learned how to hack. The humans still couldn’t secure a server.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Palo Alto Networks Unit 42 — Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Palo Alto Networks Unit 42 — An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation
