Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America

### Executive Summary Palo Alto Networks Unit 42 documents two related Latin American campaigns: CL-CRI-1131 (Mexican transportation, government, and utilities) and CL-CRI-1163 (Brazilian financial sector). Both campaigns involved multi-stage intrusions with data exfiltration, shared SOCKS5 relay infrastructure, use of custom RATs and a Go-based SockTz proxy, and notable integration of commercial LLMs (hosted via NextChat) to generate and troubleshoot post-exploitation scripts; the report includes multiple IoCs (domains, IPs, certificate hashes, URLs) and operational timelines.