Intrusion Activity in Latin America: LLM Trial and Error and SOCKS5 Relay Operations

1. Basic Information Article Title: Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America Source: Unit 42 Publication Date: 2026-09-03 Original Link: Unit 42 Related Sources: Trend Micro Vibe Hacking report Related Malware, Threat Groups, CVEs, and Products: CL-CRI-1131, CL-CRI-1163, SockTz, NextChat, Windows, JBoss AS Severity: High Review Update: Content reviewed on 2026-09-05. Clarified SockTz attempts and connection success status, evaluation entities for AI usage and failure reasons, baseless infrastructure-sharing hypotheses, and observations from both attacker and victim environments. Updated Japanese phrasing and adjusted "Visibility for Victims and Administrators" to clearly describe events appearing in screens, logs, and devices along with their observation conditions. Regional assumptions were removed from "Impact on SOCs," which was refactored into general lessons for global SOCs and enterprises regarding tracking retries, distinguishing attempts from successes, and leveraging attacker infrastructure analysis. The entire section is presented as analysis, omitting paragraph-level Inference labels to maintain concise text, and standardized to polite declarative forms. 2. Executive Summary Separate intrusion campaigns targeting Mexico and Brazil showed repeated use of scripts and SockTz. Unit 42 assesses that the attackers used LLM assistance based on repeated modifications and related infrastructure analysis, but successful SockTz connections are not explicitly confirmed in the text. 3. Attack Flow Data Collection and Related Infrastructure by the Mexican Campaign Group On already compromised Windows endpoints, attackers repeatedly attempt to acquire SAM and NTDS.dit. Facing difficulties in acquisition, they create Volume Shadow Copies across multiple drives and attempt to copy the files. Using sequential batch scripts, they collect data while adding checks for write permissions at the destination. Unit 42 observed activities coordinating a connection to 62.171.185[.]97 for data exfiltration, tracking related infrastructure via DuckDNS domains and TLS certificates. Successful external transmission of individual files or the full scope of theft requires separate verification. SockTz Deployment Attempts by the Brazilian Financial Campaign Group In the case cited by Unit 42, initial access occurred via an attachment in a phishing email disguised as a resume. After deploying multiple RATs, attackers attempt to deploy SockTz versions 1 through 8 from a compromised WordPress site. They change the download source to an attacker-managed server to retrieve version 9. Unit 42 infers that deployment or connection failures were the reason. Deployment attempts for versions 1 through 9 continued for approximately two hours. SockTz is a tool that provides reverse SOCKS5 connections, but successful connection after acquiring version 9 is not explicitly stated in the text. 4. Attacker Position and Execution Location External attackers who can already execute code on Windows endpoints. Collection scripts, RATs, and SockTz run within the victim environment. In the case documented for CL-CRI-1163, resume-disguised attachments served as the initial entry vector. NextChat and public file listings reside on the attacker's related infrastructure. They are not treated as LLMs or management interfaces on victim endpoints. 5. Visibility for Victims and Administrators Victims In the Brazilian case, victims receive phishing email attachments disguised as resumes. Inference: Victims may notice no obvious screen changes after opening the attachment and might remain unaware of RAT or tunnel deployment attempts. Administrators Inference: If EDR and other tools collect process and file access data, evidence corresponding to the Mexican campaign group may appear chronologically, including vssadmin execution, access to SAM and NTDS.dit, and the execution of sequential batch scripts. These logs alone do not confirm successful credential harvesting or external exfiltration. Inference: In the Brazilian campaign case, process, file, and network logs may show repeated acquisition of socktz_v*.exe via certutil and changes in the download source. Acquisition and startup logs alone do not indicate successful tunnel connection. Inference: If SockTz runs and attempts a connection, process startups and outbound connection attempts/results may remain in EDR logs depending on collection settings. TCP 3000 for NextChat was observed on attacker infrastructure and does not imply that communication from the victim endpoint to that destination was observed. 6. Success and Failure Conditions Success Conditions Ability to execute commands on compromised endpoints. Privileges allowing access to targets are required to collect credential files and business data. Outbound connectivity must be established to retrieve tools from outside and proceed with tunneling. Deployment attempts alone do not mean connection success. Failure Conditions and Risk Mitigation Inference: Restrict management tool privileges and limit access to SAM, NTDS.dit, and shadow copies. Apply credential protection measures after verifying protected assets, rather than assuming it universally prevents file theft on disk. Inference: Restrict unauthorized scripts and executables using application control. Inference: Restrict communications to suspicious dynamic DNS, unknown IP addresses, and unauthorized tunnels using outbound traffic allowlists. 7. What Happens Upon Success If successful, credentials such as SAM and NTDS.dit or sensitive data may be collected and exfiltrated externally. Confirm individual acquisition and exfiltration success through execution results. Inference: If a reverse SOCKS5 connection is established, it can be used for persistent access and lateral movement within the compromised environment. Do not treat deployment attempts described in this article as evidence of successful connection or lateral movement. 8. Observable Logs Email: Records of the resume-disguised attachment, its retrieval, opening, and execution. Proxy/SWG/DNS: Verify communications related to DuckDNS domains, 62.171.185[.]97, 178.128.87[.]160, 167.148.195[.]53, and the compromised WordPress site, distinguishing roles and timestamps. Do not assume all communications from victim endpoints to IPs listed in attacker infrastructure have been observed. Endpoint/EDR: Execution results of vssadmin, access to SAM and NTDS.dit, sequential batch scripts, certutil, socktz_v*.exe, and RAT execution. Identity/IdP: Inference: Check for suspicious directory queries from compromised endpoints or unauthorized use of potentially acquired credentials. SaaS/Cloud: Usage history of attacker-controlled NextChat or commercial LLMs is typically not obtainable as victim organization logs. When acquired via public research or authorized provisioning, keep it separate from victim environment observations. Network: Inference: Check retrieval from 167.148.195[.]53:8888, outbound SockTz connections, long-duration communications, and their success or failure. NextChat on TCP 3000 was confirmed on the attacker side and does not require victim organization connections. 9. Attack Success Determination The following criteria are guidelines for investigating individual environments and do not mean that success at all stages was observed in the article. Attack Attempt Observed (Success Unconfirmed): Confirm only phishing attachments or tool retrieval. If evidence shows command execution was used for retrieval, record that execution separately, but distinguish it from tool execution or tunnel success. User Action Confirmed: Confirm that the victim user opened the attachment. If code execution is confirmed, evaluate it as initial execution. Initial Execution Confirmed: Confirm execution of attack-related batch scripts, vssadmin, certutil, etc. Determine separately via outputs and artifacts whether each command succeeded in its intended process. Malware Execution or Authentication Success Confirmed: Confirm execution of RATs or SockTz through process and behavioral evidence. Confirm C2 and proxy connection success via network results; execution or retrieval alone does not constitute success. Data Theft or Session Compromise Confirmed: Confirm unauthorized acquisition and exfiltration of SAM, NTDS.dit, or business data through copy artifacts or transmission content. Acquisition command execution or connection attempts alone are not conclusive. Subsequent Compromise Confirmed: Confirm unauthorized connection to internal targets via SOCKS5 or actual lateral movement. Tunnel deployment and connection alone do not determine successful lateral movement. 10. Investigation Playbook Inference: Investigation proposals based on article observations and functional descriptions. Trigger: Combination of shadow copy creation, credential access, and sequential scripts, or repeated SockTz retrieval following RAT deployment. Do not require all characteristics of separate campaigns to appear on a single endpoint. Initial Verification: Preserve endpoint timelines, parent-child processes, sources, outbound connections, and their success/status. For the Brazilian case, check initial phishing emails. Endpoints: Examine Temp or user directories for batch/PowerShell scripts, RATs, socktz_v*.exe, shadow copies, and command execution results. Authentication/Cloud: Examine potential use of compromised credentials and directory queries. Investigate misuse of organizational LLM accounts only when evidence exists, and do not assume attacker-side NextChat appears in internal logs. Subsequent Actions: Track internal scanning, remote service usage, pre-exfiltration data aggregation, and external transmission. Verify success of tunnel-based internal connections. Containment: Isolate endpoints, block malicious communication destinations, rotate potentially exposed credentials, and remove malicious tools. Classification of Findings: Separate failed attempts, code execution, successful tunnel connections, credential acquisition, exfiltration, and lateral movement. 11. Defense and Detection Ideas Inference: Operational application proposals below. Do not conclude successful compromise based solely on matching individual logs or IOCs. Single Event: Attempted NTDS.dit copy following vssadmin execution. Single Event: Retrieval of socktz_v*.exe via certutil. Timeline Correlation: Correlate sequential script execution -> shadow copy creation -> credential file access -> data aggregation -> outbound communication. For SockTz, track retrieval repetitions, execution, and connection results. Hunting: Search for article IOCs and similarly named scripts or executables created in the same directory within a short timeframe. Record attacker infrastructure IOCs separately from communications actually observed on victim endpoints. Log Gaps: Lack of command line, execution result, file access, DNS, and outbound communication logs makes it difficult to distinguish attempts from successes. Even with complete records, this does not confirm AI assistance. Priority Actions: Prioritize credential protection, application control, outbound traffic restriction, and logging of scripts and execution results. 12. Facts / Inference / Hypothesis Facts Unit 42 tracks CL-CRI-1131 (targeting transport organizations, federal ministries, and municipal water utilities in Mexico) and CL-CRI-1163 (targeting the Brazilian financial sector) as distinct intrusion campaigns. In CL-CRI-1131, after struggling to acquire SAM and NTDS.dit, attackers were observed creating Volume Shadow Copies across multiple drives and advancing data collection while modifying sequential batch scripts. IP 178.128.87[.]160 associated with CL-CRI-1131 hosted NextChat on TCP 3000. Referencing related external reports, Unit 42 evaluates LLM usage based on handling collection failures and analyzing this infrastructure. In the CL-CRI-1131 case, intrusion occurred via a resume-disguised attachment. After deploying multiple RATs, attackers attempted to deploy SockTz, a Go-based reverse SOCKS5 tool. SockTz deployment attempts for versions 1 through 9 lasted about two hours, with download sources shifting from a compromised WordPress site to an attacker-managed server. Unit 42 indicates that this download source change may have been due to SockTz deployment or proxy connection failures. Whether connection succeeded after acquiring version 9 is not explicitly stated in the text. Public file listings include exploit_creative.py, exploit_careful.py, and rce_focused.py, which Unit 42 evaluates as material suggesting LLM generation based on naming conventions and iterative modifications. Do not treat filenames alone as definitive proof of AI usage. Inference Humans may have iteratively modified scripts while reviewing LLM outputs and execution results. However, the level of autonomous privilege granted to the AI or the extent of human intervention cannot be determined from this article. Correlating sequential scripts or repeated tool retrievals with credential access and external communications aids investigations. These behaviors alone do not identify the presence of AI assistance. Hypothesis No additional hypotheses. Unconfirmed items are listed in "Unanswered Questions and Further Investigation." 13. MITRE ATT&CK Mapping T1059.003 Command and Scripting Interpreter: Windows Command Shell (High): Repeatedly executed sequential batch scripts. T1003.003 OS Credential Dumping: NTDS (High): Attempted to acquire NTDS.dit. Verify acquisition and exfiltration success for individual attempts separately. T1090.001 Proxy: Internal Proxy (Medium): Candidate response when SockTz targets relaying from compromised environments to internal targets. Deployment attempts were observed, but connection/relay success is not explicitly stated in the text. T1105 Ingress Tool Transfer (High): Acquired SockTz using certutil and other tools. 14. Unanswered Questions and Further Investigation Attribution and interrelationship between CL-CRI-1131 and CL-CRI-1163. Similar structures alone do not confirm shared infrastructure, collaboration, or the same threat actor. Scope of data successfully acquired and exfiltrated in individual attempts, and the number of victim organizations. Connection success after acquiring SockTz version 9 and the presence of actual relaying or lateral movement. Victim organization data provided to LLMs, utilized accounts, and the extent of human intervention. 15. Impact on SOCs and Organizations A key lesson for SOCs is to view attacker trial-and-error as an interconnected chain of events. In the Mexican campaign, sequential scripts were observed; in the Brazilian campaign, repeated SockTz acquisitions and download source changes were noted. Capturing these actions requires tracking processes, files, and communications on the same endpoint chronologically rather than stopping investigations after single failures. Detecting access to credential files or unauthorized tool execution allows investigations to proceed even before AI usage can be confirmed. Assessing damage requires preserving command execution results, generated files, and connection outcomes. Separating records of tool acquisition and execution from evidence of successful credential theft or tunnel connection makes it easier to determine response actions based on verified impact. Information gained from investigating attacker infrastructure can also aid internal investigations. In this article, related infrastructure was analyzed using public file listings and TLS certificates. Matching domains and IP addresses derived from this analysis against historical DNS and communication records may help narrow down endpoints requiring further investigation. However, the mere presence of NextChat confirmed on the attacker side does not determine that connections originated from victim endpoints. 16. Summary by Target Audience For SOCs: Review vssadmin, SAM/NTDS.dit acquisition attempts, sequential scripts, certutil acquisitions, and SockTz execution/connection results chronologically. Distinguish attempts from successes. For Administrators: Restrict access to credential files, enforce script and application controls, and limit outbound traffic. Separate observations of attacker-side NextChat from victim environment monitoring. For Users: Avoid opening resume attachments indiscriminately and report suspicious executions or warnings.