Unit 42 Tracks CL-CRI-1131

Executive summary

Palo Alto Networks Unit 42 documented two active intrusion clusters in Latin America, CL-CRI-1131 and CL-CRI-1163, that combine phishing, custom RATs, living-off-the-land techniques, and the Go-based SOCKS5 proxy SockTz. Confirmed impact spans transportation organizations, federal ministries, and water services in Mexico and Ecuador, plus financial institutions in Brazil. Activity has been observed since at least February 2026, with public disclosure on September 3, 2026.

The CL-CRI-1131 campaign began with the compromise of a transportation company in Mexico, then expanded to Mexican federal ministries, and later affected municipal water services in Mexico and Ecuador. CL-CRI-1163, by contrast, targeted Brazilian financial entities through phishing emails built around job offers and resumes. Initial access still relied on email attachments, phishing, and unpatched servers, not on any AI-driven autonomous exploitation.

The operational novelty is not in the initial intrusion, but in the use of commercial language models during post-exploitation. The consolidated material points to queries made to Claude, GPT-4.1, and tools such as ChatGPT through a self-hosted NextChat instance deployed by the operators on their own infrastructure. Those queries were used for troubleshooting, exploit debugging, script generation, and exfiltration tool development.

The second technical focus is SockTz, a reverse SOCKS5 proxy written in Go. Unit 42 observed at least nine successive versions during CL-CRI-1163, with artifacts socktz_v1 through socktz_v9 appearing in under two hours within the same intrusion. That pace of iteration, along with the sequential naming and speed of the changes, has been interpreted by several sources as consistent with AI-assisted development, though not as conclusive proof of full automation.

On attribution, the available material remains cautious. Cloud Security Alliance says CL-CRI-1131 and CL-CRI-1163 are separate activities with tactical overlap, but stops short of saying they belong to the same actor. It also notes that reused infrastructure, such as IP 167.148.195[.]53 linked to SockTz and to earlier patterns against vulnerable JBoss systems, suggests operational continuity and shared infrastructure, not necessarily the same operator.

Background and context

The case surfaced at a point when several industry writeups began converging on the same pattern, classic intrusions using phishing and exposed infrastructure, then accelerated by commercial language models to produce scripts and tooling. Unit 42 was the main source for the original technical analysis, while Cloud Security Alliance, Machine Speed, SOCDefenders, Feedly, and other summaries reinforced details about geographic scope, tactics, and artifacts.

The most notable part of the context is that initial access was not novel. Cloud Security Alliance makes clear that the compromise depended on unpatched servers and phishing, and that AI did not replace the old entry paths. The novelty came later, when the operators used tools such as NextChat to interact with Claude and GPT-4.1 from their own infrastructure. At the same time, custom RATs and a Go-based SOCKS5 proxy completed an attack chain that, at its core, remains familiar to defenders and threat hunters.

The consolidated report also lets these campaigns be read as a continuation of operations against surfaces already exploited in the region. Unit 42 and supporting sources mention earlier infrastructure tied to attacks against vulnerable JBoss servers, along with patterns of IP and binary reuse. That matters because it shifts the discussion away from a supposed new attacker capability and toward tool and infrastructure reuse, but with faster iteration thanks to commercial AI assistance.

Key facts table

Operation timeline

Attack chain and TTPs

The two campaigns share a recognizable operating model. Entry was traditional, through phishing and unpatched services. After initial access, the operators used iterative scripts, living-off-the-land methods, and custom RATs to move laterally, collect credentials, and prepare exfiltration. The defining difference is the addition of commercial language models as a work assistant to speed debugging and automation development.

In CL-CRI-1131, the operators hosted a NextChat instance on their own infrastructure. According to Cloud Security Alliance, the interface was used to query Claude and GPT-4.1 for troubleshooting and for generating exploitation and automation scripts. In the same campaign, Unit 42 observed trial-and-error activity on a compromised host, consistent with an iterative tooling refinement cycle.

In CL-CRI-1163, the operation centered on phishing lures built around job offers and resumes. After access, the attackers installed multiple SockTz versions from a compromised WordPress site, working through versions 1 to 8 before pivoting to attacker-controlled infrastructure. When that deployment failed, they downloaded socktz_v9.exe from 167.148.195[.]53:8888, a node Unit 42 had already associated with campaigns against vulnerable JBoss systems.

SockTz functions as a reverse SOCKS5 proxy in Go. SecurityLab describes it as a tool capable of creating hidden paths into a victim's internal network and tunneling traffic through compromised infrastructure. That fits the post-exploitation pattern described by SOCDefenders and Cloud Security Alliance, access, persistence, tunneling, credential abuse, and exfiltration.

Regional impact

The campaigns cover three countries with a very clear sector pattern, government and critical infrastructure in Mexico and Ecuador, and financial services in Brazil. The common thread is the use of commercial AI as a post-exploitation accelerator, not as the initial access vector. That distinction matters because it clarifies where the real defense risk sits, in the post-compromise phase, persistence, and exfiltration.

Regional overview

Unit 42 describes multi-stage campaigns in Latin America that combine AI tools, custom RATs, and SockTz. Cloud Security Alliance adds that both activities have been active since at least February 2026 and that the reviewed material does not justify conclusively linking them to a single actor. There are technical overlaps, but attribution remains separate.

The combination of themed phishing, reused infrastructure, and generative tools creates a faster operational cycle. It does not introduce a new entry technique, but it does reduce friction in troubleshooting and script development. Machine Speed and Cloud Security Alliance agree on that point, and SOCDefenders provides IoCs that tie the reporting to domains, hashes, and the IP used to distribute socktz_v9.exe.

Mexico

In Mexico, CL-CRI-1131 first hit a transportation organization and later federal ministries, along with municipal water companies. The pattern points to interest in critical infrastructure and public administration, with lateral expansion inside the same geographic and sectoral environment. Unit 42 also records an April 2026 compromise that reflected trial and error tied to LLM use.

The most useful part for defenders is that the operators in this campaign used living-off-the-land methods and iterative batch scripts to manipulate and exfiltrate sensitive information. That makes them less dependent on noisy payloads and more likely to rely on legitimate tools already present in the environment. In this area, endpoint telemetry and script tracing become more valuable than malware detection alone.

Ecuador

Ecuador appears in the same cluster as Mexico, within CL-CRI-1131, with a municipal water company confirmed as a victim. The material places it within a single operational progression that starts in transportation in Mexico, passes through federal ministries, and reaches Ecuadorian water services. The research does not show a separate campaign, only expansion of the same cluster.

The analytical value of that detail lies in victim selection. Water and public administration are not collateral victims here, but part of a sustained pattern against critical infrastructure and government. The reviewed sources do not say whether there was direct operational impact on services, but they do confirm compromise and sector targeting.

Brazil

Brazil is home to CL-CRI-1163, which targeted financial institutions through job-themed phishing. Unit 42 describes email attachments with resume-themed lures as the initial vector, while Cloud Security Alliance and Feedly highlight the same line about job offers and resumes. The financial sector was the confirmed primary target.

After access, the attackers installed custom RATs and SockTz, which was iterated in at least nine versions. Machine Speed adds that socktz_v1 through socktz_v9 were deployed in less than two hours, a cadence consistent with accelerated development. Risky Biz also summarizes the Brazilian campaign as an extension of earlier attacks against vulnerable web servers, reinforcing the idea of operational continuity rather than a one-off action.

Countries with no additional verifiable facts in the main material for this investigation: Argentina, Chile, Paraguay, Bolivia, Peru, Colombia, the United States, and Uruguay.

Technical indicators

The published and consolidated IoCs are concrete, but not exhaustive. SOCDefenders provides DuckDNS domains, the SockTz download URL, and SHA-256 hashes. Unit 42 and Cloud Security Alliance provide the IP associated with the download of socktz_v9.exe and the existence of self-hosted NextChat. A complete list of every hash or domain observed by Unit 42 was not published here.

Analysis for security teams

The immediate priority is to separate two problems that are mixed together in the public narrative, initial access and post-compromise acceleration. Initial access is still the usual mix of phishing, attachments, and unpatched systems. The acceleration comes later, when the operator uses commercial models to refine scripts, debug failures, and produce exfiltration tooling. If defenders only try to stop the final malware, they are already late.

Detection should focus on several layers. In email, watch for campaigns themed around jobs, resumes, and spearphishing attachments. On endpoints, look for living-off-the-land, batches of iterative scripts, unusual RDP use, and signs of LSASS dumping. On the network, monitor DNS and traffic to the associated DuckDNS domains, IP 167.148.195[.]53, and patterns of reverse SOCKS5 proxying or persistent tunnels.

Application and web-service telemetry also matters. The material indicates reuse of compromised infrastructure, including WordPress sites used to deploy SockTz versions. That means exposed servers, web content integrity, scheduled tasks, and binaries downloaded from external nodes all need attention. If a team sees very fast iteration across binaries with sequential names, it should treat that as active development, not just testing noise.

In government, transportation, water, and banking sectors, IoCs should be cross-checked against historical traces going back to February 2026. Cloud Security Alliance recommends comparing domains, IPs, and hashes with network and endpoint telemetry. Operational priority is highest for Mexico, Ecuador, and Brazil, with a focus on SOCKS5 tunnel indicators, SockTz artifacts, and use of commercial language models on the attacker’s own infrastructure, because that reduces friction and speeds up campaigns already in motion.

What technical difference existed between CL-CRI-1131 and CL-CRI-1163?

CL-CRI-1131 focused on transportation, government, and water in Mexico and Ecuador, while CL-CRI-1163 targeted the Brazilian financial sector with job-themed phishing. Both share commercial AI use and tunneling tools, but they are not presented as a single confirmed actor. This is covered in the Regional impact section and in the Attack chain and TTPs section.

Was AI used to get in, or to operate afterward?

The material says initial access still depended on phishing and unpatched servers, not on direct AI-driven exploitation. AI appeared later, in troubleshooting, script generation, and exfiltration tooling development. That distinction appears in Background and context and in Attack chain and TTPs.

How important is SockTz in these campaigns?

SockTz was the reverse SOCKS5 proxy used to tunnel traffic and hide routes into the victim's internal network. Unit 42 and Cloud Security Alliance observed it in multiple versions, at least nine, and Machine Speed recorded a very fast deployment of socktz_v1 through socktz_v9. The details are in Attack chain and TTPs and in Technical indicators.

Which countries and sectors need immediate priority?

Mexico and Ecuador should prioritize government, transportation, and water. Brazil should prioritize financial institutions. The reason is that the material confirms victims in those sectors and shows active activity since February 2026. The country-by-country reading is in Regional impact, and the relevant IoCs are in Technical indicators.

Which published IoCs are most useful for hunting?

The DuckDNS domains, the socktz_v9.exe URL, IP 167.148.195[.]53, and the SHA-256 hashes provided by SOCDefenders are the most actionable indicators. If an organization has history going back to February 2026, it should cross-check them against DNS, web downloads, and endpoint telemetry. The full list is in Technical indicators.