Unit 42 traces LLM-assisted intrusion attempts against Mexican and Brazilian targets

What happened

Unit 42, Palo Alto Networks' threat intelligence team, has documented two separate intrusion campaigns against organizations in Latin America — one against targets in Mexico, another against Brazil's financial sector — and assesses that the operators used large language model assistance while working through their tooling. The report, published September 3, 2026 and summarized in a dev.to write-up, bases that assessment on repeated modifications to attacker scripts and analysis of related infrastructure. Notably, Unit 42 stops short of confirming that the tunneling or exfiltration steps actually succeeded.

Credential collection in the Mexican campaign

According to the report, attackers operating on already-compromised Windows endpoints repeatedly tried to obtain the SAM database and NTDS.dit, the files that hold Windows credential material. When direct acquisition proved difficult, they created Volume Shadow Copies across multiple drives and attempted to copy the files from those snapshots. Collection ran through a sequence of batch scripts that grew more defensive over time, adding checks for write permissions at the destination before copying.

Unit 42 also observed activity coordinating a connection to 62.171.185[.]97, which the researchers associate with data exfiltration, and tracked the campaign's supporting infrastructure through DuckDNS domains and TLS certificates. As elsewhere in the report, whether individual files or the full scope of stolen data ever left the network requires separate verification.

Two hours of relay retries in Brazil

The Brazilian case began with a phishing email attachment disguised as a resume. After gaining execution and deploying multiple remote access trojans, the attackers attempted to deploy SockTz — a tool that establishes reverse SOCKS5 connections, useful for tunneling into a compromised environment — in versions 1 through 8, pulled from a compromised WordPress site using certutil. When those attempts stalled, they switched the download source to an attacker-managed server to retrieve version 9, a change Unit 42 attributes to deployment or connection failures.

Attempts across versions 1 through 9 continued for roughly two hours. The report does not explicitly state that a SockTz connection was ever established after version 9 was obtained.

Where the LLMs come in

Unit 42's assessment of AI usage rests on the trial-and-error pattern of repeated script changes and on analysis of the attackers' infrastructure. On that infrastructure — not on victim machines — researchers observed a NextChat instance listening on TCP port 3000, a self-hosted chat interface typically used to reach LLM services. The report also references Trend Micro's "Vibe Hacking" research as related work on this style of AI-assisted attacking.

The distinction matters: nothing in the report shows victim endpoints communicating with the NextChat deployment. The AI usage belongs entirely to the attackers' side of the operation, and victim-side evidence of it would generally not appear in organizational logs.

What defenders can check

The observable traces differ by campaign. In the Mexican case, endpoint tooling may show vssadmin execution, access to SAM and NTDS.dit, and the batch-script sequence — evidence of attempts, not proof that credentials were harvested or exfiltrated. In the Brazilian case, process, file, and network logs may capture repeated certutil downloads of socktz_v*.exe, the change of download source, and outbound connection attempts along with their results.

On the network side, the write-up points to reviewing proxy and DNS records for the DuckDNS domains, the IPs tied to attacker infrastructure, retrieval activity from 167.148.195[.]53:8888, and any long-duration outbound sessions. Suggested mitigations include restricting the privileges needed to read SAM, NTDS.dit and shadow copies, applying application control to unauthorized scripts and executables, and using outbound allowlists to block dynamic DNS services, unknown addresses and unauthorized tunnels.

Why it matters

This is a concrete, documented signal that LLM assistance has moved into ordinary intrusion work rather than remaining a proof of concept. An operator grinding through nine versions of a tunneling tool over two hours, with an AI chat interface sitting on the same attacker infrastructure, looks less like elite tradecraft and more like assisted experimentation — the pattern Trend Micro labelled vibe hacking. That lowers the skill floor for running relay tooling and credential theft campaigns.

For security operations centers, the practical lessons are to track retries instead of dismissing each failed attempt as noise, to distinguish tool acquisition and deployment from successful connection and lateral movement, and to use attacker infrastructure analysis — domains, certificates and hosting — to link campaigns. Dense, repetitive failure logs are themselves an early-warning signal: two hours of version churn and repeated downloads are hard to miss when outbound traffic is being watched.