CybercrimeFinancial

CL-CRI-1131

CL-CRI-1131 is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 5 sectors, including Government and Finance, in 3 countries, including Mexico and Portugal. It uses 52 MITRE ATT&CK techniques and exploits 9 known CVEs.

Request IOC feed Request ATT&CK export

Techniques: 52
Exploited CVEs: 9
Last seen: Jun 19, 2026
Record updated: Oct 22, 2026

Who They Target.

Sectors · 5

Countries · 3

Labelsai-assistedcredential-theftdata-theftspanish-language-artifacts

How They Operate · MITRE ATT&CK.

52 techniques across 12 of 14 tactics

Reconnaissance7

T1046
Network Service Discovery

T1071.001
Application Layer Protocol: Web Protocols

T1082
System Information Discovery

T1590.002
Gather Victim Network Information: DNS

T1592.002
Gather Victim Host Information: Software

T1594
Search Victim-Owned Websites

T1595.002
Active Scanning: Vulnerability Scanning

Resource Development4

T1583.003
Acquire Infrastructure: Virtual Private Server

T1587.004
Develop Capabilities: Exploits

T1588.005
Obtain Capabilities: Exploits

T1608.001
Stage Capabilities: Upload Malware

Initial Access7

T1021.001
Remote Services: Remote Desktop Protocol

T1021.004
Remote Services: SSH

T1078.002
Valid Accounts: Domain Accounts

T1133
External Remote Services

T1190
Exploit Public-Facing Application

T1210
Exploitation of Remote Services

T1505.003
Server Software Component: Web Shell

Execution8

T1053
Scheduled Task/Job

T1059.001
Command and Scripting Interpreter: PowerShell

T1059.003
Command and Scripting Interpreter: Windows Command Shell

T1059.004
Command and Scripting Interpreter: Unix Shell

T1059.008
Command and Scripting Interpreter: Network Device CLI

T1105
Ingress Tool Transfer

T1119
Automated Collection

T1140
Deobfuscate/Decode Files or Information

Persistence·

Privilege Escalation1

T1068
Exploitation for Privilege Escalation

Defense Evasion3

T1027
Obfuscated Files or Information

T1036.005
Masquerading: Match Legitimate Resource Name or Location

T1573.001
Encrypted Channel: Symmetric Cryptography

Credential Access11

T1003.002
OS Credential Dumping: Security Account Manager

T1003.003
OS Credential Dumping: NTDS

T1003.008
OS Credential Dumping: /etc/passwd and /etc/shadow

T1056.003
Input Capture: Web Portal Capture

T1069.002
Permission Groups Discovery: Domain Groups

T1110.002
Brute Force: Password Cracking

T1110.003
Brute Force: Password Spraying

T1552.001
Unsecured Credentials: Credentials In Files

T1552.004
Unsecured Credentials: Private Keys

T1555.003
Credentials from Password Stores: Credentials from Web Browsers

T1558.003
Steal or Forge Kerberos Tickets: Kerberoasting

Discovery3

T1016
System Network Configuration Discovery

T1018
Remote System Discovery

T1087.002
Account Discovery: Domain Account

Lateral Movement1

T1021.002
Remote Services: SMB/Windows Admin Shares

Collection2

T1005
Data from Local System

T1213
Data from Information Repositories

Command and Control3

T1090.003
Proxy: Multi-hop Proxy

T1132.002
Data Encoding: Non-Standard Encoding

T1572
Protocol Tunneling

Exfiltration2

T1041
Exfiltration Over C2 Channel

T1048.003
Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

Impact·

Vulnerabilities They Exploit.

Browse Vulnerability Intelligence →

CVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests.Exploitedcritical CVE-2020-1938Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP connection.Exploitedcritical CVE-2022-42475Multiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or…Exploitedcritical CVE-2023-27997Fortinet FortiOS and FortiProxy SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute code or commands via…Exploitedcritical CVE-2024-21762Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.Exploitedcritical CVE-2024-21887Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products…Exploitedcritical CVE-2023-46805Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that…Exploitedhigh CVE-2021-4034The Red Hat polkit pkexec utility contains an out-of-bounds read and write vulnerability that allows for privilege escalation with administrative rights.Exploitedhigh CVE-2020-1472Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a…Exploitedmedium

Arsenal · Malware And Tools.

Neo-reGeorgmalware
ajpShooter.pytool
AnyDesktool
Assetfindertool
BloodHoundtool
Chiseltool
Dalfoxtool
deep_scan.pytool
dnsxtool
dump_batch.shtool
EternalBluetool
Findomaintool
GoBustertool
gowitnesstool
HashCattool
Impackettool
John the Rippertool
Kimeratool
LinkFindertool
Metasploittool
mkzip34.pytool
naabutool
Netcattool
NextChattool
nucleitool
PowerShelltool
ProxyChainstool
SharpHoundtool
SQL*Plustool
subfindertool
whatwebtool
XORtigatetool
ysoserialtool

Campaigns.

Operation Escaneo

About CL-CRI-1131.

CL-CRI-1131 is a tracked intrusion activity cluster associated with AI-assisted credential theft, exploitation of public-facing services and data exfiltration, principally affecting government, transportation and water services in Mexico and Ecuador. Reported operations combine webshells, reverse tunnels, proxy relays and conventional offensive tools. Financial gain is assessed as a motivation from the reported procurement and financial-data focus. The Group subtype represents an analytical activity cluster; operator count, real-world identity, origin and organizational structure remain unresolved. Operation Escaneo is associated with this cluster. An earlier AI-assisted Mexican government campaign shares infrastructure, but its reported single operator and victim set are retained as separate historical context. The last-seen date reflects a dated infrastructure observation, not confirmed activity at the time of import.

Last updated Oct 22, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.