{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 0, "deduplicated_iocs": 8, "direct_entities": 37, "direct_relationships": 38, "invalid_iocs": 0, "iocs": 8, "mentioned": 3, "mitre_associated": 0, "mitre_direct": 0, "targets": 6, "techniques": 0, "unsupported_indicators": 12, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 22, "excluded_graph_objects": 323, "graph_complete": true, "graph_objects": 37, "graph_relationships": 38, "mitre_context_complete": true, "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "status_as_of": "2026-10-10T06:12:34+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "IPv4-Addr", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.024Z", "created_at": "2026-09-25T10:59:18.718Z", "modified": "2026-09-25T10:59:30.423Z", "updated_at": "2026-09-25T10:59:30.423Z" }, "description_available": false, "entity_type": "Indicator", "id": "023a3364-db02-4774-937a-2a89d68cdc5e", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": true, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--cdf46144-e6bd-5ee3-a4ba-b47e3aef743a", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.027Z", "created_at": "2026-09-25T10:59:18.773Z", "modified": "2026-09-25T10:59:48.328Z", "updated_at": "2026-09-25T10:59:48.328Z" }, "description_available": false, "entity_type": "Indicator", "id": "03c8f295-368c-418d-9f95-078fefbd58e0", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--b4a06d43-2c6b-5cc0-b531-cf09859a0c28", "type": "Indicator" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.111Z", "modified": "2026-01-18T14:36:09.339Z", "updated_at": "2026-01-18T14:36:09.339Z" }, "description_available": false, "entity_type": "Region", "id": "0584d53c-836c-41a4-a732-0edcc5dea653", "is_inferred": false, "labels": [], "lang": "en", "name": "Americas", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "location--bce21a59-810c-5c81-863c-23546cb0d6a0", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:13.399Z", "updated_at": "2026-09-25T10:59:16.813Z" }, "description_available": false, "entity_type": "StixFile", "id": "09344d93-8601-4607-b7fc-8a55baf8ee2a", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--bae0eed5-cc89-5b53-889e-f95d4c237a44", "type": "StixFile" }, { "__typename": "Region", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:36:09.463Z", "modified": "2026-01-18T14:36:10.115Z", "updated_at": "2026-01-18T14:36:10.115Z" }, "description_available": false, "entity_type": "Region", "id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "is_inferred": false, "labels": [], "lang": "en", "name": "Latin America and the Caribbean", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "location--db71adf6-45c4-561f-9509-e84092ca174d", "type": "Region" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:08.134Z", "updated_at": "2026-09-25T10:59:09.301Z" }, "description_available": false, "entity_type": "StixFile", "id": "136eaf52-5963-4381-a29b-60ff7984a014", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--ce9df9ff-237f-5fe3-bed0-b93940946410", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:58:58.009Z", "updated_at": "2026-09-25T10:59:00.380Z" }, "description_available": false, "entity_type": "Hostname", "id": "13e8fff0-a396-47c1-86ed-4dcb0ce998ad", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "hostname--5227a3ab-3cb3-58ef-9ba6-398c64175693", "type": "Hostname" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:18.398Z", "updated_at": "2026-09-25T10:59:18.871Z" }, "description_available": false, "entity_type": "StixFile", "id": "1bd86af2-679d-4812-abe8-84a89aa7404d", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--712e4079-54f6-59ba-b256-afcd01214953", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:15.186Z", "updated_at": "2026-09-25T10:59:17.040Z" }, "description_available": false, "entity_type": "StixFile", "id": "1e4123e2-557f-4046-994b-294153d76eb4", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--9c8fd7eb-f143-58ea-843a-2e0b64842ef2", "type": "StixFile" }, { "__typename": "Country", "aliases": [ "MEX", "MX" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.025Z", "created_at": "2026-01-18T14:36:21.053Z", "modified": "2026-01-27T18:32:41.171Z", "updated_at": "2026-01-27T18:32:41.171Z" }, "description_available": false, "entity_type": "Country", "id": "2efcd93e-ca93-4b28-aa56-f9ca0975c36b", "is_inferred": false, "labels": [], "lang": "en", "name": "Mexico", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "location--c4edff4a-acf6-5ec5-86fb-577de4c8baae", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.047Z", "created_at": "2026-09-25T10:59:31.095Z", "modified": "2026-09-25T11:01:28.808Z", "updated_at": "2026-09-25T11:01:28.808Z" }, "description_available": false, "entity_type": "Indicator", "id": "3e0c74af-db99-45fb-a46c-b0a08e42d3d4", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--e039f628-d938-55ab-9129-fbb78dab4657", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.037Z", "created_at": "2026-09-25T10:59:25.249Z", "modified": "2026-09-25T11:00:40.869Z", "updated_at": "2026-09-25T11:00:40.869Z" }, "description_available": false, "entity_type": "Indicator", "id": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--c6ea7a4a-ad86-524d-b24a-536eb35f624b", "type": "Indicator" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:01.521Z", "updated_at": "2026-09-25T10:59:04.714Z" }, "description_available": false, "entity_type": "Hostname", "id": "4d6c3961-a3ae-4126-a11b-3861882ba863", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "hostname--2ce7ba18-d21d-5358-bd84-ec9af146c194", "type": "Hostname" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:39.990Z", "created_at": "2026-09-25T10:58:52.471Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-25T10:58:52.643Z", "updated_at": "2026-09-25T10:58:52.643Z" }, "description_available": false, "entity_type": "Malware", "id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "is_inferred": false, "labels": [], "lang": "en", "name": "SockTz", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "malware--5f0ec4e7-f9a6-5da5-9586-92d686a3f1b0", "type": "Malware" }, { "__typename": "IPv4Addr", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:58:57.631Z", "updated_at": "2026-09-25T10:59:04.856Z" }, "description_available": false, "entity_type": "IPv4-Addr", "id": "565e81cf-10be-44ac-ae3c-c436630d831e", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "ipv4-addr--8a976280-0190-5423-a572-d520a6d05278", "type": "IPv4Addr" }, { "__typename": "Sector", "aliases": [ "Financial", "Financial Industry (FI)", "Financial Services", "Financial-Services" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.391Z", "created_at": "2026-01-18T14:35:07.063Z", "modified": "2026-01-22T20:49:24.280Z", "updated_at": "2026-01-22T20:49:24.280Z" }, "description_available": true, "entity_type": "Sector", "id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "is_inferred": false, "labels": [], "lang": "en", "name": "Finance", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "identity--283d4ea0-b6f1-5421-bdab-117a33fdb2b7", "type": "Sector" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:09.965Z", "updated_at": "2026-09-25T10:59:11.383Z" }, "description_available": false, "entity_type": "Hostname", "id": "71d70a64-9e4f-4655-beb7-23ee3329f15f", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "hostname--bfc72780-4600-5bce-bf34-67a6ee777dc1", "type": "Hostname" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:12.254Z", "updated_at": "2026-09-25T10:59:12.597Z" }, "description_available": false, "entity_type": "Hostname", "id": "8150d3eb-375a-4d1f-9f47-251dcd8df3b3", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "hostname--9b693f68-37a1-5d98-a50b-b88166aaba16", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.040Z", "created_at": "2026-09-25T10:59:29.540Z", "modified": "2026-09-25T11:00:57.628Z", "updated_at": "2026-09-25T11:00:57.628Z" }, "description_available": false, "entity_type": "Indicator", "id": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--657079c9-6530-54ca-a443-ba551ee8de12", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.055Z", "created_at": "2026-09-25T10:59:39.203Z", "modified": "2026-09-25T11:01:42.532Z", "updated_at": "2026-09-25T11:01:42.532Z" }, "description_available": false, "entity_type": "Indicator", "id": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--1c8e77d1-7426-559d-a089-8b58699f17a6", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.029Z", "created_at": "2026-09-25T10:59:21.426Z", "modified": "2026-09-25T10:59:33.560Z", "updated_at": "2026-09-25T10:59:33.560Z" }, "description_available": false, "entity_type": "Indicator", "id": "9ba1bf8e-8e3c-45d7-87d7-602c1690a401", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--a6cd1c78-6923-59c6-9b4f-e2a3db00704a", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:06.622Z", "updated_at": "2026-09-25T10:59:07.143Z" }, "description_available": false, "entity_type": "StixFile", "id": "9f5b6995-a0c3-4529-a2ba-b777d013d2d9", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--a93f7fc6-6490-5dff-9ef3-220f031bdc02", "type": "StixFile" }, { "__typename": "Country", "aliases": [ "BR", "BRA" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.027Z", "created_at": "2026-01-18T14:36:22.143Z", "modified": "2026-01-27T18:26:50.850Z", "updated_at": "2026-01-27T18:26:50.850Z" }, "description_available": false, "entity_type": "Country", "id": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "is_inferred": false, "labels": [], "lang": "en", "name": "Brazil", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "location--080ab8c5-3ae0-5ad5-b46e-1c9506da9f65", "type": "Country" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.045Z", "created_at": "2026-09-25T10:59:30.629Z", "modified": "2026-09-25T11:01:11.713Z", "updated_at": "2026-09-25T11:01:11.713Z" }, "description_available": false, "entity_type": "Indicator", "id": "b6ee7d9f-a10e-444c-9467-6ea25ab03b83", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--19b2f842-cc63-5277-8996-498a81a7fea4", "type": "Indicator" }, { "__typename": "Sector", "aliases": [ "Shipping", "Transportation" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.390Z", "created_at": "2026-01-18T14:35:04.772Z", "modified": "2026-01-25T08:44:52.215Z", "updated_at": "2026-01-25T08:44:52.215Z" }, "description_available": true, "entity_type": "Sector", "id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "is_inferred": false, "labels": [], "lang": "en", "name": "Transport", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "identity--4a5a8971-1cd1-5a11-8843-267e17b105ac", "type": "Sector" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:01.743Z", "updated_at": "2026-09-25T10:59:04.716Z" }, "description_available": false, "entity_type": "Hostname", "id": "bd801bda-1f7d-49d7-a460-dfcdd2c375d7", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "hostname--0f3c1318-51bb-5887-b0a8-13fb7f2bd59c", "type": "Hostname" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.034Z", "created_at": "2026-09-25T10:59:25.210Z", "modified": "2026-09-25T11:00:00.581Z", "updated_at": "2026-09-25T11:00:00.581Z" }, "description_available": false, "entity_type": "Indicator", "id": "bf1d6e44-7adf-4559-baa2-175b4d5498e3", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--72002f53-b10c-5dcf-8859-3fd94219b9f2", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.052Z", "created_at": "2026-09-25T10:59:39.202Z", "modified": "2026-09-25T11:01:39.418Z", "updated_at": "2026-09-25T11:01:39.418Z" }, "description_available": false, "entity_type": "Indicator", "id": "c0341837-8bba-4daa-aafb-a11c57784035", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--4e85c625-2215-5a97-acd4-7449b6611f2d", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:09.539Z", "updated_at": "2026-09-25T10:59:11.112Z" }, "description_available": false, "entity_type": "StixFile", "id": "ca60adde-45f2-45bf-b26d-baf9c8cff55b", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--2bc5c6b4-f91a-5d72-a648-ea71fd3e284b", "type": "StixFile" }, { "__typename": "Hostname", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:06.613Z", "updated_at": "2026-09-25T10:59:07.142Z" }, "description_available": false, "entity_type": "Hostname", "id": "e08136f5-0423-4e18-a15c-1ce792050b7b", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "hostname--9cb6ab64-2ae0-50d7-9136-a8ee244b685a", "type": "Hostname" }, { "__typename": "Sector", "aliases": [ "Election", "Government", "Voting" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:33.392Z", "created_at": "2026-01-18T14:35:09.055Z", "modified": "2026-01-22T08:00:46.641Z", "updated_at": "2026-01-22T08:00:46.641Z" }, "description_available": true, "entity_type": "Sector", "id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "is_inferred": false, "labels": [], "lang": "en", "name": "Government and administrations", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "identity--9d697b63-6ae0-5ddb-ae26-e3d6e03302e1", "type": "Sector" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.058Z", "created_at": "2026-09-25T10:59:50.507Z", "modified": "2026-09-25T11:01:48.566Z", "updated_at": "2026-09-25T11:01:48.566Z" }, "description_available": false, "entity_type": "Indicator", "id": "e32417f3-adcf-4b98-866f-c9b591e8b745", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--8653cf1f-74b4-5de5-9669-f0d496257572", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.050Z", "created_at": "2026-09-25T10:59:36.097Z", "modified": "2026-09-25T11:01:33.645Z", "updated_at": "2026-09-25T11:01:33.645Z" }, "description_available": false, "entity_type": "Indicator", "id": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--1f24562f-0bd1-5aa4-a85b-8e0c2cc12121", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Hostname", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.032Z", "created_at": "2026-09-25T10:59:25.210Z", "modified": "2026-09-25T11:00:15.674Z", "updated_at": "2026-09-25T11:00:15.674Z" }, "description_available": false, "entity_type": "Indicator", "id": "e992369f-5077-41c6-a912-9627f14fe8d6", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--53ddaab0-feb8-5e34-8116-f85640330b0e", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.042Z", "created_at": "2026-09-25T10:59:30.769Z", "modified": "2026-09-25T11:01:23.513Z", "updated_at": "2026-09-25T11:01:23.513Z" }, "description_available": false, "entity_type": "Indicator", "id": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "indicator--e887467c-a491-5393-bcb4-84cecdaca774", "type": "Indicator" }, { "__typename": "Country", "aliases": [ "EC", "ECU" ], "attributes": {}, "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.028Z", "created_at": "2026-01-18T14:36:22.590Z", "modified": "2026-02-25T04:37:07.906Z", "updated_at": "2026-02-25T04:37:07.906Z" }, "description_available": false, "entity_type": "Country", "id": "f7843d4f-c049-4ac8-bd1f-76fb38a6e55d", "is_inferred": false, "labels": [], "lang": "en", "name": "Ecuador", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "location--1bff27e9-e543-541a-82d4-a038aee458fb", "type": "Country" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-25T10:59:13.162Z", "updated_at": "2026-09-25T10:59:14.574Z" }, "description_available": false, "entity_type": "StixFile", "id": "f818579f-f922-4f94-a902-06f8ae82aa01", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "file--91bb3937-f3b1-5145-9034-58469470beb0", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.098Z", "created_at": "2026-09-25T11:04:10.338Z", "modified": "2026-09-25T11:04:10.635Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:04:10.635Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e992369f-5077-41c6-a912-9627f14fe8d6", "from_id": "e992369f-5077-41c6-a912-9627f14fe8d6", "from_name": null, "from_type": "Indicator", "id": "08cf982f-6cc2-4620-93b2-ff0e0bd94b84", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--6f33f35d-e289-599d-9b61-9c390e49d4ae", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.140Z", "created_at": "2026-09-25T11:08:47.033Z", "modified": "2026-09-25T11:08:48.292Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:08:48.292Z" }, "description_available": false, "entity_type": "indicates", "fromId": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "from_id": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "from_name": null, "from_type": "Indicator", "id": "1328280d-7902-4112-899c-807861f73243", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--b95da034-f491-5e22-a2f1-c21eedf0d944", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.027Z", "created_at": "2026-01-18T14:38:30.508Z", "modified": "2026-01-18T14:38:30.805Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:30.805Z" }, "description_available": true, "entity_type": "located-at", "fromId": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "from_id": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "from_name": "Brazil", "from_type": "Country", "id": "15bd6a7d-6175-4ab2-9dfb-812c78752260", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--0b7cf069-836b-5517-8633-51c5ce8069b7", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.014Z", "created_at": "2026-01-18T14:37:59.735Z", "modified": "2026-01-18T14:38:00.115Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:00.115Z" }, "description_available": true, "entity_type": "located-at", "fromId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "from_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "from_name": "Latin America and the Caribbean", "from_type": "Region", "id": "1a7e18bf-4118-4428-bb9d-d97927778771", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--333d7612-4184-5ace-a7eb-618c9acd457a", "toId": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "to_name": "Americas", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.127Z", "created_at": "2026-09-25T11:07:17.109Z", "modified": "2026-09-25T11:07:19.345Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:07:19.345Z" }, "description_available": false, "entity_type": "indicates", "fromId": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "from_id": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "from_name": null, "from_type": "Indicator", "id": "1e9bfad4-1454-4add-9ed1-4bb3a46bf952", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--430524f1-c657-5d68-9410-9e79efa6a923", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.051Z", "created_at": "2026-09-25T11:02:16.254Z", "modified": "2026-09-25T11:02:17.197Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:17.197Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "from_id": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "from_name": null, "from_type": "Indicator", "id": "2fdc0b59-526c-4fa7-9947-90aa0a96ea5a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--466df74e-88b6-5cad-a696-19a044283dc5", "toId": "f818579f-f922-4f94-a902-06f8ae82aa01", "to_id": "f818579f-f922-4f94-a902-06f8ae82aa01", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.111Z", "created_at": "2026-09-25T11:05:12.371Z", "modified": "2026-09-25T11:05:15.469Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:05:15.469Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bf1d6e44-7adf-4559-baa2-175b4d5498e3", "from_id": "bf1d6e44-7adf-4559-baa2-175b4d5498e3", "from_name": null, "from_type": "Indicator", "id": "30999c56-4578-40f1-a567-6a9e59749e50", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--761f9a36-c072-50fc-b268-7fe26e16f29d", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.173Z", "created_at": "2026-09-25T11:09:48.092Z", "modified": "2026-09-25T11:09:48.266Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:09:48.266Z" }, "description_available": false, "entity_type": "indicates", "fromId": "3e0c74af-db99-45fb-a46c-b0a08e42d3d4", "from_id": "3e0c74af-db99-45fb-a46c-b0a08e42d3d4", "from_name": null, "from_type": "Indicator", "id": "3495ee9d-5ff4-47b1-a77e-55e42a4fb690", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--59f6bfde-a388-5757-b056-240bad0a70ca", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.035Z", "created_at": "2026-09-25T11:02:08.858Z", "modified": "2026-09-25T11:02:09.230Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:09.230Z" }, "description_available": false, "entity_type": "based-on", "fromId": "bf1d6e44-7adf-4559-baa2-175b4d5498e3", "from_id": "bf1d6e44-7adf-4559-baa2-175b4d5498e3", "from_name": null, "from_type": "Indicator", "id": "3768b881-4cab-4e54-9bb1-5f3dcad0ecb3", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--fc5d787c-6ae0-5ed3-a440-22979d502f3f", "toId": "e08136f5-0423-4e18-a15c-1ce792050b7b", "to_id": "e08136f5-0423-4e18-a15c-1ce792050b7b", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.195Z", "created_at": "2026-09-25T11:10:15.003Z", "modified": "2026-09-25T11:10:15.273Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:10:15.273Z" }, "description_available": false, "entity_type": "indicates", "fromId": "c0341837-8bba-4daa-aafb-a11c57784035", "from_id": "c0341837-8bba-4daa-aafb-a11c57784035", "from_name": null, "from_type": "Indicator", "id": "3c13fecf-a5e7-48e0-a983-b594c6f2c624", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--a195d378-6143-5c18-ac24-2ffc6eceefc0", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.023Z", "created_at": "2026-09-25T11:00:59.634Z", "modified": "2026-09-25T11:01:09.314Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:01:09.314Z" }, "description_available": false, "entity_type": "targets", "fromId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_name": "SockTz", "from_type": "Malware", "id": "44305230-dce1-4d73-a982-d402a4d7ebf9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--a09fe57e-b84d-5a3e-a180-1498415e5580", "toId": "2efcd93e-ca93-4b28-aa56-f9ca0975c36b", "to_id": "2efcd93e-ca93-4b28-aa56-f9ca0975c36b", "to_name": "Mexico", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.060Z", "created_at": "2026-09-25T11:02:19.740Z", "modified": "2026-09-25T11:02:20.398Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:20.398Z" }, "description_available": false, "entity_type": "indicates", "fromId": "023a3364-db02-4774-937a-2a89d68cdc5e", "from_id": "023a3364-db02-4774-937a-2a89d68cdc5e", "from_name": null, "from_type": "Indicator", "id": "496a3f01-b3a7-4a5e-9d89-f1870fcc18db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--3692140c-1715-5687-89f6-5450cc492080", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.059Z", "created_at": "2026-09-25T11:02:18.800Z", "modified": "2026-09-25T11:02:19.942Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:19.942Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e32417f3-adcf-4b98-866f-c9b591e8b745", "from_id": "e32417f3-adcf-4b98-866f-c9b591e8b745", "from_name": null, "from_type": "Indicator", "id": "4be690cd-0cd0-4f43-9558-647690440fc8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--5b1358ee-ecd7-5d9d-bf26-ad68ea8ddc1f", "toId": "1bd86af2-679d-4812-abe8-84a89aa7404d", "to_id": "1bd86af2-679d-4812-abe8-84a89aa7404d", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.162Z", "created_at": "2026-09-25T11:09:34.135Z", "modified": "2026-09-25T11:09:34.413Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:09:34.413Z" }, "description_available": false, "entity_type": "indicates", "fromId": "b6ee7d9f-a10e-444c-9467-6ea25ab03b83", "from_id": "b6ee7d9f-a10e-444c-9467-6ea25ab03b83", "from_name": null, "from_type": "Indicator", "id": "5278e2b0-b2e6-4edd-b8f9-18f28a8bfd62", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--6cb6398b-ed01-57cf-aa51-355747ea6738", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.033Z", "created_at": "2026-09-25T11:02:07.872Z", "modified": "2026-09-25T11:02:08.493Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:08.493Z" }, "description_available": false, "entity_type": "based-on", "fromId": "e992369f-5077-41c6-a912-9627f14fe8d6", "from_id": "e992369f-5077-41c6-a912-9627f14fe8d6", "from_name": null, "from_type": "Indicator", "id": "5a8d3b1f-97d9-4d1a-a0c7-e425918589c7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--3e18a2ce-cb17-5d1c-be81-62ebbdb30692", "toId": "bd801bda-1f7d-49d7-a460-dfcdd2c375d7", "to_id": "bd801bda-1f7d-49d7-a460-dfcdd2c375d7", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.206Z", "created_at": "2026-09-25T11:10:28.567Z", "modified": "2026-09-25T11:10:28.726Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:10:28.726Z" }, "description_available": false, "entity_type": "indicates", "fromId": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "from_id": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "from_name": null, "from_type": "Indicator", "id": "657727a3-20e4-4ed5-a3ec-9223e40e7b13", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--55ee31d7-a956-583d-ad87-56654a2b8151", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.026Z", "created_at": "2026-09-25T11:02:01.510Z", "modified": "2026-09-25T11:02:02.027Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:02.027Z" }, "description_available": false, "entity_type": "based-on", "fromId": "023a3364-db02-4774-937a-2a89d68cdc5e", "from_id": "023a3364-db02-4774-937a-2a89d68cdc5e", "from_name": null, "from_type": "Indicator", "id": "74835e2d-142b-429c-b780-713da96ec208", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--a6fdd5f3-dd1d-5cbf-bc7f-9d672503b91d", "toId": "565e81cf-10be-44ac-ae3c-c436630d831e", "to_id": "565e81cf-10be-44ac-ae3c-c436630d831e", "to_name": null, "to_type": "IPv4Addr" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.044Z", "created_at": "2026-09-25T11:02:12.623Z", "modified": "2026-09-25T11:02:15.413Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:15.413Z" }, "description_available": false, "entity_type": "based-on", "fromId": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "from_id": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "from_name": null, "from_type": "Indicator", "id": "748d0feb-884e-48b4-ad7e-c4670f5c3dac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--5ce9c9fc-8179-5aac-bcc7-effa3d9ac776", "toId": "ca60adde-45f2-45bf-b26d-baf9c8cff55b", "to_id": "ca60adde-45f2-45bf-b26d-baf9c8cff55b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.151Z", "created_at": "2026-09-25T11:09:19.316Z", "modified": "2026-09-25T11:09:19.633Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:09:19.633Z" }, "description_available": false, "entity_type": "indicates", "fromId": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "from_id": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "from_name": null, "from_type": "Indicator", "id": "8c149283-6d2e-4387-a2a0-75654c0634db", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--e6ff37a1-ca31-5a6c-ae87-0378883a7e0f", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.049Z", "created_at": "2026-09-25T11:02:15.155Z", "modified": "2026-09-25T11:02:15.647Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:15.647Z" }, "description_available": false, "entity_type": "based-on", "fromId": "3e0c74af-db99-45fb-a46c-b0a08e42d3d4", "from_id": "3e0c74af-db99-45fb-a46c-b0a08e42d3d4", "from_name": null, "from_type": "Indicator", "id": "8fbdf9fc-b025-49f4-969f-9e3453ca3a93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--cfc6b76c-9920-5b55-87c6-0bf09c7ea621", "toId": "8150d3eb-375a-4d1f-9f47-251dcd8df3b3", "to_id": "8150d3eb-375a-4d1f-9f47-251dcd8df3b3", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.056Z", "created_at": "2026-09-25T11:02:16.649Z", "modified": "2026-09-25T11:02:18.487Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:18.487Z" }, "description_available": false, "entity_type": "based-on", "fromId": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "from_id": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "from_name": null, "from_type": "Indicator", "id": "980305b2-67c1-4b4f-9459-474fe8e30078", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--32994d2e-0c3b-55d5-9773-4a377855c292", "toId": "1e4123e2-557f-4046-994b-294153d76eb4", "to_id": "1e4123e2-557f-4046-994b-294153d76eb4", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.041Z", "created_at": "2026-09-25T11:02:09.734Z", "modified": "2026-09-25T11:02:12.535Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:12.535Z" }, "description_available": false, "entity_type": "based-on", "fromId": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "from_id": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "from_name": null, "from_type": "Indicator", "id": "9cb890c5-7fe9-49b5-a9d1-de68cc6001fd", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--97b20131-448d-5cbe-b3a3-22a036d7a116", "toId": "136eaf52-5963-4381-a29b-60ff7984a014", "to_id": "136eaf52-5963-4381-a29b-60ff7984a014", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.184Z", "created_at": "2026-09-25T11:10:00.207Z", "modified": "2026-09-25T11:10:02.855Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:10:02.855Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "from_id": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "from_name": null, "from_type": "Indicator", "id": "aaa71099-3ec4-4858-8485-a72a6ab8aba1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--f2fb7dc0-7926-523b-8cb0-54832d8c34ec", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.022Z", "created_at": "2026-09-25T11:01:15.743Z", "modified": "2026-09-25T11:01:20.206Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:01:20.206Z" }, "description_available": false, "entity_type": "targets", "fromId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_name": "SockTz", "from_type": "Malware", "id": "b595b0c4-8fc6-425e-8396-dd55e43bb239", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--0e544c09-b449-5f22-9c74-3d51912924ee", "toId": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "to_id": "b5b790c2-a035-47ca-a4d2-052b8dfa17e7", "to_name": "Brazil", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.054Z", "created_at": "2026-09-25T11:02:16.649Z", "modified": "2026-09-25T11:02:18.486Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:18.486Z" }, "description_available": false, "entity_type": "based-on", "fromId": "c0341837-8bba-4daa-aafb-a11c57784035", "from_id": "c0341837-8bba-4daa-aafb-a11c57784035", "from_name": null, "from_type": "Indicator", "id": "ba12a454-d114-4ee0-b398-e65839ff8812", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--9d8d0aa6-2931-5df6-a42c-860e3b938874", "toId": "09344d93-8601-4607-b7fc-8a55baf8ee2a", "to_id": "09344d93-8601-4607-b7fc-8a55baf8ee2a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.086Z", "created_at": "2026-09-25T11:03:20.593Z", "modified": "2026-09-25T11:03:21.705Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:03:21.705Z" }, "description_available": false, "entity_type": "indicates", "fromId": "9ba1bf8e-8e3c-45d7-87d7-602c1690a401", "from_id": "9ba1bf8e-8e3c-45d7-87d7-602c1690a401", "from_name": null, "from_type": "Indicator", "id": "bf7571cb-95b8-4628-9c8d-b96eda77a9b6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--6acf2ecd-570e-540f-9eb0-ac2c00a7fb53", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.020Z", "created_at": "2026-09-25T11:00:02.128Z", "modified": "2026-09-25T11:00:05.612Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:00:05.612Z" }, "description_available": false, "entity_type": "targets", "fromId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_name": "SockTz", "from_type": "Malware", "id": "cbcd5fdb-1d27-4dc8-9526-c10c7a47bcd6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--68da70a9-ff64-5f18-88bb-7d5806bb85b2", "toId": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_id": "6839ec2a-a1ec-4851-b89f-8923c0d36135", "to_name": "Finance", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.029Z", "created_at": "2026-01-18T14:38:37.060Z", "modified": "2026-01-18T14:38:37.269Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:37.269Z" }, "description_available": true, "entity_type": "located-at", "fromId": "f7843d4f-c049-4ac8-bd1f-76fb38a6e55d", "from_id": "f7843d4f-c049-4ac8-bd1f-76fb38a6e55d", "from_name": "Ecuador", "from_type": "Country", "id": "d2780195-6813-42d2-b6be-da5cc88a18a6", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--23e6e128-c31b-5dea-8ada-1b5164c73dec", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.039Z", "created_at": "2026-09-25T11:02:09.053Z", "modified": "2026-09-25T11:02:09.454Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:09.454Z" }, "description_available": false, "entity_type": "based-on", "fromId": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "from_id": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "from_name": null, "from_type": "Indicator", "id": "d2b25db4-8b08-4349-adb5-5b8fc3b56efc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--24861801-0db1-514c-a752-1029f1c192eb", "toId": "9f5b6995-a0c3-4529-a2ba-b777d013d2d9", "to_id": "9f5b6995-a0c3-4529-a2ba-b777d013d2d9", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.019Z", "created_at": "2026-09-25T10:59:54.103Z", "modified": "2026-09-25T10:59:58.033Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T10:59:58.033Z" }, "description_available": false, "entity_type": "targets", "fromId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_name": "SockTz", "from_type": "Malware", "id": "d5bf8a12-8f5b-404b-b743-faeb1e8c2af9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--53e6480b-723d-5de9-a0cc-28b493fed82c", "toId": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "to_id": "bb18ac82-fd34-482d-9921-90bafe3ad39d", "to_name": "Transport", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 100, "created_by": { "authorized_members": [], "id": "efbfcf33-f10e-4a90-9ed4-e4de602fb038", "is_inferred": false, "name": "Filigran", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2023-11-19T00:56:37.025Z", "created_at": "2026-01-18T14:38:26.406Z", "modified": "2026-01-18T14:38:26.650Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-18T14:38:26.650Z" }, "description_available": true, "entity_type": "located-at", "fromId": "2efcd93e-ca93-4b28-aa56-f9ca0975c36b", "from_id": "2efcd93e-ca93-4b28-aa56-f9ca0975c36b", "from_name": "Mexico", "from_type": "Country", "id": "d9771a3a-6637-4a5a-a277-41159166e38e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "located-at", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--45308ce5-2f7c-5ff1-bc04-2410e3290f93", "toId": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "to_name": "Latin America and the Caribbean", "to_type": "Region" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.225Z", "created_at": "2026-09-25T11:10:41.627Z", "modified": "2026-09-25T11:10:41.836Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:10:41.836Z" }, "description_available": false, "entity_type": "indicates", "fromId": "e32417f3-adcf-4b98-866f-c9b591e8b745", "from_id": "e32417f3-adcf-4b98-866f-c9b591e8b745", "from_name": null, "from_type": "Indicator", "id": "df1e75bd-a269-4b63-b660-c321ab14695f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--92e39e93-2bb0-5dd0-82c1-ab84ebf4fa4d", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.072Z", "created_at": "2026-09-25T11:02:48.580Z", "modified": "2026-09-25T11:02:48.928Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:48.928Z" }, "description_available": false, "entity_type": "indicates", "fromId": "03c8f295-368c-418d-9f95-078fefbd58e0", "from_id": "03c8f295-368c-418d-9f95-078fefbd58e0", "from_name": null, "from_type": "Indicator", "id": "e14720d1-9b83-4ed5-a838-e4ad904976c9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--f7d49f7f-5861-5655-b63b-4a16f02080f1", "toId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "to_name": "SockTz", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.020Z", "created_at": "2026-09-25T11:00:09.015Z", "modified": "2026-09-25T11:00:16.599Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:00:16.599Z" }, "description_available": false, "entity_type": "targets", "fromId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_name": "SockTz", "from_type": "Malware", "id": "e35eae58-aad7-49be-b1d0-7884911d8d47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--21aacf24-404a-5ee4-bda9-b97e1deb89ce", "toId": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_id": "e0c5fe0a-97bf-4b3e-98d5-2ab527abde8a", "to_name": "Government and administrations", "to_type": "Sector" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.046Z", "created_at": "2026-09-25T11:02:12.619Z", "modified": "2026-09-25T11:02:15.411Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:15.411Z" }, "description_available": false, "entity_type": "based-on", "fromId": "b6ee7d9f-a10e-444c-9467-6ea25ab03b83", "from_id": "b6ee7d9f-a10e-444c-9467-6ea25ab03b83", "from_name": null, "from_type": "Indicator", "id": "e733d823-f174-447c-8c83-168babc436ea", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--fce6a13e-9af3-5a71-9c54-ed98df40fda2", "toId": "71d70a64-9e4f-4655-beb7-23ee3329f15f", "to_id": "71d70a64-9e4f-4655-beb7-23ee3329f15f", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.023Z", "created_at": "2026-09-25T11:00:22.056Z", "modified": "2026-09-25T11:00:27.224Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:00:27.224Z" }, "description_available": false, "entity_type": "targets", "fromId": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "from_name": "SockTz", "from_type": "Malware", "id": "eb8a786e-de9f-4b4d-a8d9-c68fdb2b6898", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "targets", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--16935c74-7b7e-5843-964c-64b85bf89930", "toId": "f7843d4f-c049-4ac8-bd1f-76fb38a6e55d", "to_id": "f7843d4f-c049-4ac8-bd1f-76fb38a6e55d", "to_name": "Ecuador", "to_type": "Country" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.028Z", "created_at": "2026-09-25T11:02:02.554Z", "modified": "2026-09-25T11:02:03.839Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:03.839Z" }, "description_available": false, "entity_type": "based-on", "fromId": "03c8f295-368c-418d-9f95-078fefbd58e0", "from_id": "03c8f295-368c-418d-9f95-078fefbd58e0", "from_name": null, "from_type": "Indicator", "id": "f67779f2-1277-47ac-a5db-6c1c2f4d4c0f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--25841824-28b5-5190-b2da-57b327aefaf0", "toId": "13e8fff0-a396-47c1-86ed-4dcb0ce998ad", "to_id": "13e8fff0-a396-47c1-86ed-4dcb0ce998ad", "to_name": null, "to_type": "Hostname" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:47:40.031Z", "created_at": "2026-09-25T11:02:05.974Z", "modified": "2026-09-25T11:02:08.104Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-25T11:02:08.104Z" }, "description_available": false, "entity_type": "based-on", "fromId": "9ba1bf8e-8e3c-45d7-87d7-602c1690a401", "from_id": "9ba1bf8e-8e3c-45d7-87d7-602c1690a401", "from_name": null, "from_type": "Indicator", "id": "f81e1286-82e5-45d2-8239-491a345a3684", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "standard_id": "relationship--a72c4a37-8a78-5b42-b27b-ce69e7c7f71e", "toId": "4d6c3961-a3ae-4126-a11b-3861882ba863", "to_id": "4d6c3961-a3ae-4126-a11b-3861882ba863", "to_name": null, "to_type": "Hostname" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "167[.]148[.]195[.]53", "description_available": false, "object_id": "023a3364-db02-4774-937a-2a89d68cdc5e", "object_ids": [ "023a3364-db02-4774-937a-2a89d68cdc5e", "565e81cf-10be-44ac-ae3c-c436630d831e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "023a3364-db02-4774-937a-2a89d68cdc5e", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2026-09-23T18:19:55.434Z", "validity_status": "revoked", "value": "167.148.195.53" }, { "classification": "observable", "confidence": null, "context": "Objet IPv4Addr explicitement associé au rapport source.", "object_id": "565e81cf-10be-44ac-ae3c-c436630d831e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "167.148.195.53" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "ipv4", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2026-09-23T18:19:55.434Z", "validity_status": "revoked", "value": "167.148.195.53" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "29eee8a0e2c63360e361a0d462d30ae6", "description_available": false, "object_id": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "object_ids": [ "1e4123e2-557f-4046-994b-294153d76eb4", "94c9efbb-5d57-4689-8c35-0f1c673b0a58" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "94c9efbb-5d57-4689-8c35-0f1c673b0a58", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "29eee8a0e2c63360e361a0d462d30ae6" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "1e4123e2-557f-4046-994b-294153d76eb4", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "29eee8a0e2c63360e361a0d462d30ae6" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "md5", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "29eee8a0e2c63360e361a0d462d30ae6" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4e58c2617eeee39bb7492040f25d22d2eca263e1", "description_available": false, "object_id": "e32417f3-adcf-4b98-866f-c9b591e8b745", "object_ids": [ "1bd86af2-679d-4812-abe8-84a89aa7404d", "e32417f3-adcf-4b98-866f-c9b591e8b745" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e32417f3-adcf-4b98-866f-c9b591e8b745", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "4e58c2617eeee39bb7492040f25d22d2eca263e1" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "1bd86af2-679d-4812-abe8-84a89aa7404d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4e58c2617eeee39bb7492040f25d22d2eca263e1" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "sha1", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "4e58c2617eeee39bb7492040f25d22d2eca263e1" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c", "description_available": false, "object_id": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "object_ids": [ "ca60adde-45f2-45bf-b26d-baf9c8cff55b", "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "f55cd743-7cbf-4cab-9bc2-7d2a0c63b325", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "ca60adde-45f2-45bf-b26d-baf9c8cff55b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "sha256", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5", "description_available": false, "object_id": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "object_ids": [ "136eaf52-5963-4381-a29b-60ff7984a014", "8e496eb6-7a18-4317-a33f-faf02bca4aae" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "8e496eb6-7a18-4317-a33f-faf02bca4aae", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "136eaf52-5963-4381-a29b-60ff7984a014", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "sha256", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8", "description_available": false, "object_id": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "object_ids": [ "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "9f5b6995-a0c3-4529-a2ba-b777d013d2d9" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "434a9ebf-dba8-4d66-8728-a203b35a0aa7", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "9f5b6995-a0c3-4529-a2ba-b777d013d2d9", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "sha256", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec", "description_available": false, "object_id": "c0341837-8bba-4daa-aafb-a11c57784035", "object_ids": [ "09344d93-8601-4607-b7fc-8a55baf8ee2a", "c0341837-8bba-4daa-aafb-a11c57784035" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "c0341837-8bba-4daa-aafb-a11c57784035", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "09344d93-8601-4607-b7fc-8a55baf8ee2a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "sha256", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "87bf8bc8b4a2cf34f0af1afe161f123a3d200e77f6c6f41b81bf6ae66ee172ec" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996", "description_available": false, "object_id": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "object_ids": [ "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "f818579f-f922-4f94-a902-06f8ae82aa01" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "e7915c4f-10a7-4392-a6c5-c8f5a5bea262", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f818579f-f922-4f94-a902-06f8ae82aa01", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996" } ], "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/", "type": "sha256", "valid_from": "2026-09-03T12:45:16.000Z", "valid_until": "2027-06-20T23:55:00.557Z", "validity_status": "active", "value": "a38b2cf8beff32a276eed8783723ecf8cc53d7dc88669e1b998dddc4db6fe996" } ], "mentioned": [ { "confidence": 50, "evidence_id": "52ae71c0-1694-4f34-8b94-dc723d8be82e", "name": "SockTz", "role": "mentionné", "type": "Malware" }, { "confidence": 100, "evidence_id": "0584d53c-836c-41a4-a732-0edcc5dea653", "name": "Americas", "role": "mentionné", "type": "Region" }, { "confidence": 100, "evidence_id": "0acfb4ac-3826-406c-a6d0-f89b3036b81e", "name": "Latin America and the Caribbean", "role": "mentionné", "type": "Region" } ], "mitre": { "associated_repertoire": [], "direct_techniques": [] }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-03T12:45:15.963Z", "created_at": "2026-09-25T11:10:55.924Z", "modified": "2026-09-25T11:11:11.817Z", "published": "2026-09-03T12:45:15.963Z", "updated_at": "2026-09-25T11:11:11.817Z" }, "description_available": true, "id": "3c587918-e619-4246-99fb-845e62630e03", "is_inferred": false, "labels": [ "ai-enabled attacks", "nextchat", "phishing campaign", "socks5 proxy", "socktz" ], "lang": "en", "name": "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-03T12:45:15.963Z", "references": [ { "external_id": null, "id": "70a52ab5-dd2d-4295-a35e-ffee4a8874bb", "source_name": "alien-vault", "url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/" }, { "external_id": "6a996bdbc61a482545ffaa1c", "id": "d9ac6b15-5dcf-44c2-a2a0-e226a3bad1b3", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6a996bdbc61a482545ffaa1c" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/" }, "targets": [ { "confidence": 50, "evidence_id": "b595b0c4-8fc6-425e-8396-dd55e43bb239", "name": "Brazil", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "eb8a786e-de9f-4b4d-a8d9-c68fdb2b6898", "name": "Ecuador", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "cbcd5fdb-1d27-4dc8-9526-c10c7a47bcd6", "name": "Finance", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "e35eae58-aad7-49be-b1d0-7884911d8d47", "name": "Government and administrations", "role": "cible déclarée (relation targets)", "type": "Sector" }, { "confidence": 50, "evidence_id": "44305230-dce1-4d73-a982-d402a4d7ebf9", "name": "Mexico", "role": "cible déclarée (relation targets)", "type": "Country" }, { "confidence": 50, "evidence_id": "d5bf8a12-8f5b-404b-b743-faeb1e8c2af9", "name": "Transport", "role": "cible déclarée (relation targets)", "type": "Sector" } ], "techniques": [], "vulnerabilities": [] }, "report_id": "3c587918-e619-4246-99fb-845e62630e03", "schema_version": 1, "selected_date": "2026-09-03", "source_url": "https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/" }