Hackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America

Threat actors targeting organizations across Latin America are increasingly embedding commercial large language models (LLMs) into intrusion workflows, using AI-assisted scripting, troubleshooting, and proxy deployment to accelerate post-exploitation and data theft.

The campaigns show that AI is no longer limited to phishing, content generation, or reconnaissance.

Instead, attackers appear to be using LLMs as an operational support layer for generating scripts, correcting failed commands, refining tooling and managing multi-stage actions after initial access.

The first cluster, tracked as CL-CRI-1131, compromised a transportation organization and also targeted Mexican federal ministries and municipal water utilities in Mexico and Ecuador.

Operators primarily relied on living-off-the-land techniques, abusing native Windows capabilities instead of immediately deploying bespoke malware.

During an April 2026 intrusion, the attackers repeatedly attempted to extract high-value credential material, including the Windows Security Account Manager registry hive and the Active Directory NTDS.dIT database.

After initial failures, they iteratively modified batch scripts, created Volume Shadow Copies across drives, copied protected files and added permission checks to ensure data could be written into staging directories.

The rapid sequence of script changes was consistent with LLM-assisted troubleshooting rather than a prebuilt, static playbook.

The exposed interface was hosted on attacker-controlled infrastructure, enabling operators to use commercial models such as Claude and GPT-4.1 while retaining a centralized workspace for prompts and output.

This backend became a major operational-security failure. Rather than concealing the AI-supported workflow, exposed infrastructure gave defenders visibility into the operators’ staging environment, suspected target interests and evolving tooling.

The second campaign, CL-CRI-1163, targeted Brazilian financial organizations through job-themed phishing activity and the deployment of custom remote-access Trojans.

Unlike the Mexico-focused operation, this cluster used purpose-built malware alongside an iterative Go-based reverse SOCKS5 tunneling utility called SockTz.

Unit 42 has linked the activity to two separate but technically overlapping clusters: CL-CRI-1131, focused on Mexico and Ecuador, and CL-CRI-1163, which targeted Brazil’s financial sector.

LLM-Powered Cyberattacks

Researchers observed attackers attempting to deploy versions one through eight of SockTz from a compromised WordPress server in roughly two hours.

Unit 42 researchers found that, infrastructure tied to the campaign included a self-hosted instance of NextChat, an open-source interface that can connect to multiple AI models.

Following apparent installation or connectivity failures, the operators pivoted to separate attacker-controlled infrastructure to retrieve a ninth build.

This rapid versioning suggests AI-enabled trial-and-error development, where actors can repeatedly request revised code or configuration changes without requiring deep malware-development expertise.

An exposed directory associated with the infrastructure also contained scripts bearing names such as exploit_creative.py, exploit_careful.py and rce_focused.py.

Those descriptive, iterative filenames resemble language-model output patterns and indicate that LLMs may have been used to generate or refine exploit and remote-code-execution routines.

Although Unit 42 tracks the operations as distinct clusters with different victim profiles, the campaigns shared overlapping SOCKS5 relay infrastructure and a common reliance on AI-enabled operational workflows.

The Mexico/Ecuador campaign favored native Windows utilities and batch-script automation, while the Brazil operation used phishing, RATs and custom tunneling malware.

Both, however, used LLMs to overcome execution problems and streamline post-compromise activity.

The findings also align with earlier Trend Micro reporting on AI-augmented campaigns targeting Latin American government and financial entities, which it tracks as SHADOW-AETHER-040 and SHADOW-AETHER-064.

Trend Micro described these as emerging cases of actors using agentic AI to support operations spanning initial access through data exfiltration.

The core risk is not that AI independently conducts sophisticated intrusions; it is that LLMs lower the time, skill and iteration cost of post-exploitation.

An operator who struggles to dump credentials, establish a proxy route or modify an exfiltration script can use a model to produce alternatives and continue the intrusion quickly.

Defenders should prioritize monitoring for suspicious shadow-copy activity, attempts to access SAM and NTDS.dit, rapid creation of numbered scripts or binaries, anomalous SOCKS5 tunnels, and outbound connections to dynamic-DNS infrastructure.

They should also inspect exposed servers and web directories for staging artifacts, as the attackers’ poor OpSec including exposed NextChat instances and open directories remains a valuable detection and attribution opportunity.

Palo Alto Networks recommends protections including Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, Cortex XDR and XSIAM for activity related to these campaigns.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.