#ParsedReport #CompletenessHigh
03-09-2026

Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/

Report completeness: High

Actors/Campaigns:
Escaneo
Cl-cri-1163

Threats:
Socktz_tool
Lolbin_technique
Shadow_copies_delete_technique

Victims:
Transportation sector, Federal government ministries, Municipal water utilities, Financial sector

Industry:
Transport, Government

Geo:
Ecuador, Brazilian, Mexico, Latin america

TTPs:
Tactics: 1
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1003.002, T1003.003, T1059.003, T1090, T1105, T1566.001, T1572

IOCs:
File: 2
IP: 4
Domain: 6
Hash: 2
Url: 1

Soft:
ChatGPT, Claude, Claude code, NextChat, WildFire, GPT-4, WordPress, JBoss, Active Directory

Algorithms:
sha256

Languages:
golang

Platforms:
intel