ATTACKERS EXPOSE ONGOING AI TOOL USE TARGETING ORGANIZATIONS IN LATIN AMERICA

Summary from the TLDR InfoSec newsletter

Two intrusion clusters targeting Latin American critical infrastructure accidentally exposed their operations by leaving a self-hosted NextChat instance open to the public on TCP 3000. The exposed prompt history and staging scripts revealed a heavy reliance on AI tools to rapidly iterate through failed SAM and NTDS.dit credential dumps using volume shadow copy workarounds. To detect this infrastructure, defenders should actively hunt for the m-doxa on duckdns[.]org subdomains and monitor for multi-SAN Let's Encrypt certificates rotated between February and June.