CyberCartel

CyberCartel is a financially motivated cybercrime group active since at least 2012 that targets Latin American businesses, particularly banks, payment providers and mobile payment applications. Its activities include stealing passwords, API keys, customer information and financial account data, as well as obtaining unauthorized access to bank accounts. Its targeting includes Mexico and payment infrastructure associated with the SPEI interbank payment system. CyberCartel uses CARLIY0S, an AI-assisted, multi-agent attack framework linked to operators working as the Tr4nsHack Team under the name Hexagon Security Labs Mexico. The framework combines Anthropic Claude, xAI Grok and Moonshot AI Kimi models with PentAGI, scripts, browser automation, residential proxies and shared operational data. Specialized agents analyze targets, propose actions and review recommendations before an arbiter returns a decision. These workflows support reconnaissance, exploitation of financial organizations' web systems, and post-compromise collection of credentials and sensitive information. CARLIY0S has supported targeting of more than 400 financial organizations across Latin America, although successful compromise of every target has not been established. A snapshot of its FinancialSoft collection database contained 4,493 records; possession of credentials does not establish their successful use. Operators disguise harmful requests as authorized testing or academic research and switch to alternative models or local code when requests are refused. The operation combines human direction with automated tools rather than demonstrating fully autonomous attacks.