CyberCartel Leverages Claude and Grok AI for Mass Attacks on 400+ Financial Firms
A cybercrime group known as CyberCartel has employed an AI-driven framework, CARLIY0S, integrating models from Anthropic's Claude and xAI's Grok, to automate and scale sophisticated attacks against over 400 banks and financial institutions in Latin America.
A sophisticated cybercrime operation, dubbed CyberCartel, has been orchestrating large-scale attacks against more than 400 banks, payment providers, and other financial organizations across Latin America by leveraging an advanced AI-driven attack framework named CARLIY0S. This framework, detailed in a report by cybersecurity firm Straiker, integrates large language models (LLMs) from prominent providers like Anthropic (Claude) and xAI (Grok), alongside Moonshot AI's Kimi models, to automate and streamline various stages of cyberattacks.
The CARLIY0S framework is designed to empower a smaller team of operators to manage a significantly larger number of targets and reduce the time spent on manual reconnaissance and operational tasks. It functions as an AI-driven attack ecosystem, connecting various AI agents with specialized software tools and managing shared data. These agents are assigned distinct roles, such as analyzing target information, proposing attack vectors, and coordinating subsequent actions. The system's architecture allows for a collaborative approach where one AI agent might analyze data and suggest actions, while another reviews these suggestions and makes final decisions, mimicking a human-led operation but at an accelerated pace.
Straiker's investigation, which involved examining the group's own systems, revealed that CARLIY0S relies on PentAGI, an automated security-testing framework, combined with custom scripts and AI model configurations. The report indicates that the operators attempted to disguise their malicious requests to AI systems as authorized security testing or academic research, a tactic aimed at bypassing AI safety filters. This method highlights a growing trend of threat actors attempting to exploit the perceived legitimacy of AI tools for nefarious purposes.
The integration of specific AI models is noteworthy. Claude models were reportedly used for analysis and decision-making, while Grok models assisted in collecting sensitive data into a database named FinancialSoft. Moonshot AI's Kimi models served as a fallback mechanism when other AI systems refused requests. This multi-agent setup, where AI output is directly linked to operational tools for inspecting web traffic, managing data, and supporting automated tasks, represents a significant leap in the automation of cybercrime.
According to Straiker, the CARLIY0S framework utilized automated browser software and residential proxy services to conduct its operations. The attackers focused on exploiting the web systems of financial organizations, searching for credentials and sensitive information after gaining initial access. A snapshot of the FinancialSoft database reviewed by Straiker contained 4,493 records, including email addresses, account numbers, passwords, and API keys, some of which were linked to critical infrastructure like Mexico's SPEI interbank payment system.
While the presence of these credentials does not confirm successful breaches of all targeted institutions, it signifies a substantial risk of fraud and further unauthorized access. The report emphasizes that AI is not acting independently but rather augmenting human operators, scripts, and infrastructure. The true danger lies in the interconnectedness of these components and the broad access they are granted.
Adding to the defense, Straiker noted that the operators had fallback methods, including local code, to circumvent AI model rejections. This means that even if AI providers revoke credentials or block access, the broader operation may continue by switching to alternative tools or existing scripts. Straiker confirmed that Anthropic revoked a credential associated with this activity, and xAI was notified and is investigating the reported use of Grok.
For financial institutions, the practical response involves strengthening identity and payment system security, limiting the permissions granted to automated tools, and enhancing monitoring for unusual account or API activity. Reviewing connected services, such as support portals and payment interfaces, in addition to core banking systems, is crucial. This case serves as a stark warning about the speed and reach that AI-driven automation can bring to cybercrime, underscoring the continued importance of robust access controls, vigilant monitoring, and rapid credential revocation.