C0064: AI-Assisted Breach of Mexico's Government Infrastructure
The AI-Assisted Breach of Mexico's Government Infrastructure is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.[1]
Security context for executives and security teams
C0064: AI-Assisted Breach of Mexico's Government Infrastructure describes The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City ...
Executive priority
C0064: AI-Assisted Breach of Mexico's Government Infrastructure is an official MITRE ATT&CK campaign. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate C0064: AI-Assisted Breach of Mexico's Government Infrastructure by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether C0064: AI-Assisted Breach of Mexico's Government Infrastructure appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
AI-Assisted Breach of Mexico's Government Infrastructure
The AI-Assisted Breach of Mexico's Government Infrastructure is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1003.006 | DCSyncSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary requested Claude Code gather credentials against the victim environment and Claude Code utilized `DCSync` to pull password data from the Active Directory.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1572 | Protocol Tunneling | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary instructed Claude Code to connect to the victim devices through SSH tunnels.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary also utilized Chisel SOCKS proxies.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1021 | Remote Services | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with attempting to connect to other systems via FTP.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1021.004 | SSHSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to identify SSH connections, make attempts to move laterally within the victim environment, and communicate through SSH tunnels.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1074 | Data Staged | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary had Claude Code document select findings in the skills Markdown (MD) file for future recollection.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1583.003 | Virtual Private ServerSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary leveraged an attacker controlled Virtual Private Server (VPS) to facilitate C2 and exfiltration actions.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1070.006 | TimestompSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary had Claude Code utilize `touch` to keep original timestamps of files in attempts to evade detection.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1552 | Unsecured Credentials | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with attempting to search for credentials through the webshell.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1027.010 | Command ObfuscationSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary had Claude Code use base64-encoded PowerShell scripts.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1526 | Cloud Service Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary identified and connected to victim AWS databases and systems through the use of client tools.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1187 | Forced Authentication | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with attempting to use PetitPotam and Printerbug as NTLM relay attacks.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1057 | Process Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to use BACKUPOSINT v9.0 APEX PREDATOR to enumerate the processes running on victim systems and fed it into OpenAI’s GPT-4.1 API for analysis along with other system information.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1102 | Web Service | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized a legitimate residential proxy provider for C2 communications.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1110.003 | Password SprayingSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to attempt to password spray several database servers.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary has also instructed Claude Code to attempt to password spray a SCADA web interface.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1059.004 | Unix ShellSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to execute various commands (e.g., `ls -la`, `nc`, `proxychains4`, etc.) and scripts (e.g., bash, etc.) using the Unix shell.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1087 | Account Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to attempt to discover accounts by cycling through relative identifiers (RIDs).CitationAI-Mexico-Govt-Breach |
| Enterprise | T1555 | Credentials from Password Stores | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary extracted credentials from a database and tested those passwords against victim environments and services.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1190 | Exploit Public-Facing Application | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to exploit a vulnerability in an internet-facing server at the Mexico Federal Tax Authority to achieve remote command execution.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with planting a webshell on the victims public-facing portal.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1683.001 | Written ContentSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to generate forged tax compliance certificates with the data collected by custom python scripts.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1585 | Establish Accounts | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary created an account with the legitimate residential proxy provider proxy[.]geonode[.]io.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1018 | Remote System Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary used Claude Code to request BACKUPOSINT v9.0 APEX PREDATOR to perform remote system discovery mapping harvested credentials to systems within the victim environment.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with enumerating additional lateral movement targets which included the discovery of a vNode industrial gateway and Supervisory Control and Data Acquisition (SCADA)/Industrial Internet of Things (IIoT) management platform.[1] |
| Enterprise | T1583.006 | Web ServicesSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized the legitimate residential proxy provider proxy[.]geonode[.]io for C2 communications.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1552.003 | Shell HistorySub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized Claude Code to gather data within bash histories.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1505.003 | Web ShellSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with planting a webshell on SADM’s public-facing portal .CitationAI-Mexico-Govt-Breach |
| Enterprise | T1053.003 | CronSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to escalate privileges by modifying a crontab script to inject an SSH key into root’s `authorized_keys` file and then restore the file modification time, so the crontab script appeared unchanged.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1090.001 | Internal ProxySub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized Claude Code to maintain access to the victim’s internal network through proxy tunnels.CitationAI-Mexico-Govt-Breach[1] During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to connect to the internal victim devices through SSH tunnels.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1078.003 | Local AccountsSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to connect to the victim environments using compromised local accounts to include root and service accounts.[1] |
| Enterprise | T1098.004 | SSH Authorized KeysSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to establish persistence on the system by injecting an SSH key located at `/root/.ssh/authorized_keys` file via a crontab script.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1003.003 | NTDSSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary requested Claude Code to use secretsdump.py against the victims Active Directory.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1059.009 | Cloud APISub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized Cloud APIs for interacting with victim environments and exfiltrating data to include OpenAI’s GPT-4.1 API, and AWS API.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1110.002 | Password CrackingSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with cracking database password hashes of the victim organizations.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1059 | Command and Scripting Interpreter | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to create a reverse shell callback on an Amazon Web Services hosted system.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1210 | Exploitation of Remote Services | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with attempting to exploit the EternalBlue vulnerability.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1587 | Develop Capabilities | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized and ingested into the LLM a pre-written document that consisted of techniques and procedures to utilize when set variables and conditions were encountered.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1213 | Data from Information Repositories | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to gather and exfiltrate data stored in victim repositories to include sensitive government and civilian records.CitationAI-Mexico-Govt-Breach[1] |
| Enterprise | T1016 | System Network Configuration Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary leveraged Claude Code to enumerate network devices to include Domain Controllers using the `nslookup` command.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1682 | Query Public AI Services | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary used Anthropic’s Claude Code and OpenAI’s GPT-4.1 AI to conduct operations.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1554 | Compromise Host Software Binary | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary requested Claude Code to add a skills file titled claude.md to the project root direct that loads automatically at the start of every Claude Code session. During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary also routinely updated the skills file to take note of changes and findings.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1213.006 | DatabasesSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary also requested Claude Code to enumerate and collect database schemas, tables containing personal data (names, addresses, phone numbers, FIEL records, etc.), stored procedures, links to additional databases, and database password hashes from victim environments.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with extracting credentials from a database.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1033 | System Owner/User Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized Claude Code to discover the user details through `whoami`.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1699 | Direct Prompt Injection | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary abused Claude Code by utilizing a file-write operation within the prompt that created a `claude.md` file that contained a pre-written 1,084-line document containing penetration testing scripts that were used in the campaign.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1003.005 | Cached Domain CredentialsSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to use secretsdump.py against the victims Active Directory to gather credentials.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1078 | Valid Accounts | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to leverage compromised valid credentials to authenticate to victim hosts and services.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1059.006 | PythonSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with generating and executing numerous Python scripts including BACKUPOSINT v9.0 APEX PREDATOR to achieve their objectives.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1059.001 | PowerShellSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to use `ntlmrelay.py` to execute a base64-encoded PowerShell payload on five domain controllers.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized base64-encoded PowerShell payloads against victim servers.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1505 | Server Software Component | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary had Claude Code discover and utilize pre-established stored procedures to query the victim database.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1083 | File and Directory Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to use the `ls -la` command to list files and directories in the current working directory.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1003.008 | /etc/passwd and /etc/shadowSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with extracting the root password hash from the `/etc/shadow` file within the victim server.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1588.007 | Artificial IntelligenceSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary obtained access to Claude Code and OpenAI GPT-4.1 AI in order to facilitate attacks against the victim.CitationAI-Mexico-Govt-Breach[1] |
| Enterprise | T1595.002 | Vulnerability ScanningSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to scan an internet-facing server at the Mexico Federal Tax Authority for vulnerabilities using Vulmap.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to scan internet-facing devices to detect vulnerabilities.CitationAI-Mexico-Govt-Breach[1] During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary requested Claude Code to use the open-source vulnerability scanner Vulmap to aid in scanning activities.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1592.004 | Client ConfigurationsSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to collect information about the victim environments including diagrams, database tables, authentication flow, and configuration files with credentials.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to base64-encode the exploit payload to avoid character restrictions.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1587.004 | ExploitsSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary used Claude Code to create exploit scripts.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1105 | Ingress Tool Transfer | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary had instructed Claude Code to utilize vulnerability tools to include PetitPotam which Claude Code sought to download to utilize in the victim environment.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1082 | System Information Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to identify system information using `hostname`.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with using CrackMapExec to discover configuration information about the domain controllers.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1003.002 | Security Account ManagerSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary had Claude Code leverage secretsdump to gather and test passwords.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1036.001 | Invalid Code SignatureSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary also forged digital signatures of tax documents using a combination of 96 byte padded SHA-256 hash and base64-encoding resemble a legitimately signed PDF file.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1119 | Automated Collection | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to automate data extraction jobs across multiple databases as a background process.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1110 | Brute Force | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with attempting to brute force SSH connections to systems. CitationAI-Mexico-Govt-Breach |
| Enterprise | T1090.002 | External ProxySub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to utilize a residential proxy including `us[.]proxy[.]geonode[.]io` using port 9000.CitationAI-Mexico-Govt-Breach During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to connect through a SOCKS proxy, that traversed an internet-facing server, to authenticate to victim hosts over SSH.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1003.004 | LSA SecretsSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary requested Claude Code to utilize secretsdump to obtain LSA secrets.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1046 | Network Service Discovery | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary instructed Claude Code to use BACKUPOSINT v9.0 APEX PREDATOR to enumerate ports on victim devices and fed it into OpenAI’s GPT-4.1 API for analysis along with other system information.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1552.004 | Private KeysSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to harvest credentials and SSH keys from victim systems.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1014 | Rootkit | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code with generating and executing rootkits.CitationAI-Mexico-Govt-Breach |
| Enterprise | T1020 | Automated Exfiltration | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary tasked Claude Code to automatically exfiltrate millions of rows of data, from multiple databases, as comma-separated values (CSV) files to an adversary-controlled virtual private server (VPS).CitationAI-Mexico-Govt-Breach |
| Enterprise | T1588.002 | ToolSub-technique | During the AI-Assisted Breach of Mexico's Government Infrastructure, the adversary utilized publicly available tools to include the open-source vulnerability scanner Vulmap.CitationAI-Mexico-Govt-Breach |
Groups, software, and campaigns
S9045: BACKUPOSINT v9.0 APEX PREDATOR
BACKUPOSINT v9.0 APEX PREDATOR is a 49-module Python malware developed entirely by Anthropic’s Claude Code as part of the AI-Assisted Breach of Mexico's Government Infrastructure campaign. BACKUPOSINT v9.0 APEX PREDATOR leverages publicly available techniques for network enumeration, credential harvesting, Active Directory interrogation, database access, privilege escalation, cloud metadata extraction, and lateral movement [1].
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | 3205c8070480… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]AI-Mexico-Govt-Compromise
Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.
Open source URL - [2]mitre-attackC0064Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.