THE report from Palo Alto Networks details two sophisticated cyberattack campaigns targeting organizations in Latin America, using artificial intelligence (AI) to enhance their operations. The campaigns are classified into two clusters: the Mexican Transportation Campaign (CL-CRI-1131) and the Brazilian Financial Campaign (CL-CRI-1163).
1. **Mexican Transportation Campaign (CL-CRI-1131)**:
- Targets include a transportation organization and various government entities in Mexico and Ecuador.
- Utilizes living-off-the-land (LotL) techniques and NextChat for data manipulation and exfiltration.
- Attackers experienced initial difficulties gathering sensitive data but adapted through trial and error.
- Threat actors used a single TLS certificate for multiple subdomains, revealing their operations targeted federal institutions.
2. **Brazilian Financial Campaign (CL-CRI-1163)**:
- Focuses on the Brazilian financial sector involving phishing tactics and job-themed scams.
- Attackers deployed custom remote access trojans (RATs) and advanced tunneling tools along with AI-assisted scripting.
- Evidence of AI usage was found in the naming conventions of operational scripts, suggesting automated, AI-generated processes.
The report concludes that while these campaigns showcase advanced tech use (AI and proxies), they also reveal operational security weaknesses that can be exploited by defenders.