Loading story…
Two active intrusion and data-exfiltration clusters, CL-CRI-1131 and CL-CRI-1163, targeted Latin American organizations in 2026. CL-CRI-1131 compromised a Mexican transportation organization and pursued Mexican and Ecuadorian government and water-utility targets, collecting data with living-off-the-land techniques. CL-CRI-1163 targeted Brazil’s financial sector through resume-themed phishing, deploying custom remote-access trojans and evolving versions of the Go-based reverse SOCKS5 proxy SockTz.
Researchers identified overlapping SOCKS5 relay infrastructure across the campaigns, alongside exposed staging systems and AI-interface infrastructure, including a NextChat deployment. The infrastructure, certificates, script directories, and predictable naming patterns suggest the operators used commercial LLM tools to troubleshoot execution failures and develop or refine operational scripts. Defenders can use those exposed artifacts and relay-infrastructure overlaps to hunt, track, and disrupt the activity.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
CL-CRI-1131-associated infrastructure obtained an additional multi-SAN TLS certificate, further linking its exposed infrastructure to the campaign's tracked DuckDNS-hosted services.
Infrastructure associated with CL-CRI-1131 remained active through June. The cluster also targeted Mexican federal ministries and municipal water utilities in Mexico and Ecuador, using DuckDNS subdomains and data-exfiltration-related infrastructure.
CL-CRI-1131-associated infrastructure obtained a multi-SAN TLS certificate, one of the certificates later associated with host 178.128.87[.]160, which exposed a NextChat LLM web interface.
CL-CRI-1131 intrusion activity was observed against a transportation organization in Mexico. Operators repeatedly attempted to collect the SAM registry hive and Active Directory NTDS.dit database, including by creating volume shadow copies and using numbered batch scripts to stage collected data.
Infrastructure associated with CL-CRI-1131 used a single-subject-alternative-name TLS certificate, later linked to host 165.22.184[.]26 through its certificate fingerprint.
CL-CRI-1163 likely obtained initial access to Brazilian financial-sector targets through a resume-themed phishing email attachment. The operators subsequently deployed custom remote-access Trojans and attempted to install successive SockTz reverse-SOCKS5 proxy versions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcetrendmicro.com
Open sourcecdn.prod.website-files.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CloudSEK disclosed a coordinated intrusion campaign dubbed **Operation Escaneo** that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing **Fortinet FortiOS SSL-VPN**, **Ivanti Connect Secure**, and **Apache Tomcat** systems, while also maintaining capabilities for `EternalBlue`, `Zerologon`, `GhostCat`, `Log4Shell`, and `PwnKit`. CloudSEK attributed the activity with medium confidence to **MexicanMafia**, also tracked as **PanchoVilla**, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations. The attackers used a custom reconnaissance framework called **Kimera**, **Neo-reGeorg** web shells, **Chisel** reverse tunnels, and persistence on compromised Cisco routers through **GRE tunnels** to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as **RDP**, **PsExec**, and **Impacket** for lateral movement and privilege escalation. Reported theft included a **407 MB BloodHound** Active Directory dataset, more than **1.3 million personal records**, and **SSL private keys**, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Jun 29, 2026
APT-C-36 has continued a long-running spam and spear-phishing campaign targeting organizations primarily in **Colombia**, with additional victims identified in **Ecuador, Spain, and Panama**. The activity has hit multiple sectors, including **government, finance, healthcare, telecommunications, and energy, oil and gas**, using Spanish-language lures to deliver malware through phishing emails. Researchers reported that the group regularly changes its tradecraft to sustain access and reduce detection, rotating **link shorteners** and swapping in different **commodity remote access trojans (RATs)** as payloads. The campaign also uses **geolocation filtering** to narrow targeting and evade analysis, and its victimology and operational patterns indicate a motive aligned more with **financial gain** than traditional espionage.
Aug 14, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026