Intrusion into Latin America: Experience Using LLM and Operations via SOCKS5 Relay

Introduction

In recent times, Latin America has seen an active use of artificial intelligence (AI) tools for conducting attacks on organizations. According to Unit 42 data, attackers regularly use scripts and SOCKS5 Relay for their purposes. In this article, we will delve into the discovered attacks, their methods, and protection recommendations.

Description of Attacks

Basic Information

The attacks were detected in Mexico and Brazil. During the analysis, the use of Large Language Models (LLM) and SOCKS5 Relay was identified. Attackers regularly modified their scripts and analyzed infrastructure, indicating support for AI. However, specific successful co

ections using SOCKS5 Relay have not been confirmed.

Security Status

The threat is assessed as high. Within the research, several criteria were considered, including successful attempts to access SAM and NTDS.dit on compromised Windows machines, as well as attempts to create Volume Shadow Copies for file copying.

Analysis of the Attack

Data Collection and Related Infrastructure Phase

The Mexican attack group actively used compromised Windows computers to gain access to account systems and NTDS.dit. If data retrieval encounters issues, they create Volume Shadow Copies on multiple disks and attempt to copy files. This indicates that attackers are using complex methods to achieve their goals.

# Example code for creating Volume Shadow Copies
import os
import subprocess

def create_volume_shadow_copy(drive_letter):
    try:
        subprocess.run(f'vssadmin create shadow /for={drive_letter}:', shell=True)
        print(f"Volume Shadow Copy created for {drive_letter}:")
    except Exception as e:
        print(f"Error creating Volume Shadow Copy for {drive_letter}: {e}")

create_volume_shadow_copy('C')

Protection Recommendations

Enhancing Monitoring and Analysis

To prevent such attacks, it is necessary to strengthen monitoring and analysis of systems. Security teams should be vigilant about unusual activities and quickly respond to any suspicious actions.

Utilizing LLM in Attack Analysis

AI tools can help in analyzing and detecting attacks. However, it is important to correctly interpret results and not overestimate their significance.

Ensuring Infrastructure Security

It is necessary to ensure robust protection for all infrastructure, including servers and workstations. Using the latest software versions and regular system updates can significantly enhance security levels.

Conclusion

Attacks on Latin America using AI and SOCKS5 Relay pose a serious threat to organizations. Security teams must be prepared for complex and multi-step attacks and apply modern protection methods. Regular monitoring and the use of AI tools can help in detecting and preventing such attacks.