Kiberjinoyatchilar Lotin Amerikasidagi 400 dan ortiq moliyaviy muassasalar va to‘lov provayderlariga qarshi hujumlarni muvofiqlashtirish uchun CARLIY0S deb nomlangan ko‘p agentli tizimdan foydalandi.
Tizim Anthropic’ning Claude, xAI’ning Grok va Moonshot AI’ning Kimi kabi tijorat AI modellarini avtomatlashtirish va umumiy operatsion infratuzilma bilan birlashtirdi.
Straiker o‘z xulosalarini guruhning ish muhitidagi artefaktlardan olganini aytadi, bu esa AI jinoiy operatsiyaga qanday kiritilganini g‘ayrioddiy ko‘rish imkonini beradi.
Hisobotda qo‘lda xakerlik va skriptlardan o‘tib, kichik guruhga ko‘plab nishonlarni baholash va ta’qib qilishda yordam berish uchun mo‘ljallangan muvofiqlashtirilgan tizimga o‘tish tasvirlanadi.
400 dan ortiq raqam nishonga olingan tashkilotlarga tegishli; bu har bir tashkilot buzilganini isbotlamaydi.
CARLIY0S yagona AI modeli yoki zararli dastur namunasi emas edi. PentAGI hujum xavfsizligi tizimi atrofida qurilgan bo‘lib, u modellarga turli vazifalarni taqsimladi.
Claude agentlari nishonlarni tahlil qilish, mumkin bo‘lgan yondashuvlarni baholash va qarorlarni sintez qilish uchun sozlangan; Grok bilan ishlaydigan “konchilar” FinancialSoft deb nomlangan ma’lumotlar bazasi uchun ma’lumot to‘plagan; va Kimi modellari tizim ish jarayonida paydo bo‘lgan.
Hisobotda aytilishicha, operatorlar modellarning so‘rovlarini rad etganida mahalliy kod zaxirasi ham bo‘lgan, ya’ni rad etish operatsiyani to‘xtatmagan.
Straiker ba’zi model sozlamalari yozuvlari o‘sha modellarning muvaffaqiyatli chaqirilganini isbotlamasligini ogohlantiradi.
Tergov AI tomonidan yaratilgan tahlilni brauzerlar, trafik tekshiruvi, umumiy ma’lumotlar va operator infratuzilmasi bilan bog‘laydigan kengroq vositalar zanjirini tasvirlaydi.
Straiker guruh AI so‘rovlarini ruxsat etilgan xavfsizlik sinovi sifatida shakllantirgan, avtomatlashtirilgan brauzer faoliyati va turar-joy proksi xizmatlaridan foydalanganini aytadi.
Uning xabar qilingan buzilishdan keyingi maqsadlari orasida ma’lumotnomalarni qidirish, ichki tizimlarni xaritalash va sezgir moliyaviy hamda shaxsiy ma’lumotlarni to‘plash bor edi.
Bu tafsilotlar muhim, chunki xavf faqat model nimani yaratishi mumkinligida emas, balki uning natijasi vositalar va haqiqiy dunyo kirishi bilan qanday bog‘lanishida hamdir.
Tr4nsH4ck Team tomonidan tayyorlangan Jabrlanuvchi Inventarining Boshqaruv Paneli (Manba: Straiker).
Straiker tomonidan AiPT-67 sifatida kuzatilgan guruh Hexagon Security Labs Mexico nomi ostida Tr4nsHack Team sifatida faoliyat yuritgan. Straiker uni 2012-yildan beri faol bo‘lgan moliyaviy yo‘naltirilgan tahdid aktori CyberCartel bilan bog‘laydi.
Claude va Grokdan Foydalanish
FinancialSoft’ning 2026-yil 24-sentabrdagi suratida 4 493 ta yozuv, jumladan 2 911 ta elektron pochta manzili va 903 ta hisob raqami, shuningdek parollar, API kalitlari va boshqa kirish materiallari borligi xabar qilingan.
Straiker shuningdek, to‘lov infratuzilmasi va Meksikaning SPEI banklararo to‘lov tizimi bilan bog‘liq ma’lumotnomalarni ham xabar qildi. Firma jabrlanuvchi tashkilotlar anonimlashtirilganini va jonli ma’lumotnomalar hamda ekspluatatsiya materiallari qizil rang bilan o‘chirilganini aytadi.
CARLIY0S Ko‘p Agentli Tuzilmasi (Manba: Straiker).
Bular Straiker tomonidan xabar qilingan xulosalar bo‘lib, mustaqil ravishda tasdiqlangan muvaffaqiyatli buzilishlar yoki moliyaviy yo‘qotishlar ro‘yxati emas.
Oshkor qilish AI provayderlari tomonidan ham chora ko‘rishga sabab bo‘ldi. Straiker Anthropic Claude’ga kirish uchun ishlatilgan buzilgan ma’lumotnomani bekor qilganini, bu yo‘lni to‘xtatganini, xAI esa xabardor qilinganini va Grok konchilari bilan bog‘liq faoliyatni tekshirayotganini aytadi.
Bu javob muhim, ammo u ko‘p modelli operatsiyani to‘xtatish uchun bitta provayderga tayanishning cheklovini ham ko‘rsatadi: hujumchilar modellarni almashtirishi, mahalliy koddan foydalanishi yoki an’anaviy vositalar bilan davom etishi mumkin.
Himoyachilar uchun asosiy dars operatsiondir. AI razvedka, tahlil va muvofiqlashtirishni tezlashtirishi mumkin, ammo u o‘g‘irlangan ma’lumotnomalar, zaif xizmatlar yoki yomon kirish nazoratiga bo‘lgan ehtiyojni yo‘qotmaydi.
CARLIY0S Operatsion Darajalari (Manba: Straiker).
Banklar va to‘lov firmalari ma’lumotnomalar va API kalitlarini aylantirish, eng kam huquq bilan kirish, shaxsiy va to‘lov tizimlarini himoya qilish, hamda hisoblar, yakuniy nuqtalar va ilovalar bo‘ylab shubhali faoliyatni bog‘laydigan monitoringni ustuvor qilishlari kerak.
Xavfsizlik jamoalari shuningdek, AI agentlari va ular erisha oladigan vositalar hamda ma’lumotlar inventarini saqlab qolishlari, va bu agentlar noto‘g‘ri ishlatilishi yoki ruxsatlaridan tashqari harakat qilishga majbur qilinishi mumkinligini sinab ko‘rishlari kerak.
CARLIY0S kiberjinoyatchilik qanday tashkil etilishi mumkinligidagi o‘zgarishni ko‘rsatadi: AI endi faqat alohida vazifalar uchun emas, balki muvofiqlashtirilgan hujum ish jarayonining bir qismi sifatida ishlatilmoqda.
Inson operatorlari markaziy o‘rinda qoladi; tizimning ahamiyati shundaki, u ularga tezroq va kengroq miqyosda ishlashda yordam berishi mumkin.
Cybercriminals used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers across Latin America.
The system combined commercial AI models including Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi with automation and shared operational infrastructure.
Straiker says its findings came from artifacts in the group’s working environment, offering an unusual view of how AI was incorporated into a criminal operation.
The report describes a shift from manual hacking and scripts toward an orchestrated system intended to help a small group assess and pursue many targets.
The figure of more than 400 refers to organizations targeted; it does not establish that every organization was breached.
CARLIY0S was not a single AI model or malware sample. Built around the PentAGI offensive-security framework, it assigned models different tasks.
Claude agents were configured to analyze targets, assess possible approaches and synthesize decisions; Grok-powered “miners” gathered information for a database called FinancialSoft; and Kimi models appeared in the system’s workflow.
The report says the operators also had a local code fallback when models refused requests, meaning a refusal did not necessarily stop the operation.
Straiker cautions that some model configuration entries do not prove those models were successfully invoked.
The investigation describes a wider tool chain connecting AI-generated analysis to browsers, traffic inspection, shared data and operator infrastructure.
Straiker says the group used AI prompts framed as authorized security testing, automated browser activity and residential proxy services.
Its reported post-compromise objectives included searching for credentials, mapping internal systems and collecting sensitive financial and identity data.
These details matter because the risk lies not only in what a model can generate, but in how its output is connected to tools and real-world access.
Dashboard made by Tr4nsH4ck Team of a Victim’s Inventory (Source : Straiker).
The group, tracked by Straiker as AiPT-67, operated as Tr4nsHack Team under the name Hexagon Security Labs Mexico. Straiker links it to CyberCartel, a financially focused threat actor it says has been active since 2012.
Claude and Grok Exploited
A September 24, 2026 snapshot of FinancialSoft reportedly contained 4,493 records, including 2,911 email addresses and 903 account numbers, along with passwords, API keys accessand other access material.
Straiker also reported credentials associated with payment infrastructure and Mexico’s SPEI interbank payment system. The firm says victim organizations were anonymized and live credentials and exploit material were redacted.
CARLIY0S Multi-Agent structure (Source : Straiker).
These are findings reported by Straiker, not an independently verified tally of successful intrusions or financial losses.
The disclosure also prompted action by AI providers. Straiker says Anthropic revoked the compromised credential used to access Claude, cutting off that route, while xAI was notified and was investigating activity associated with the Grok miners.
That response is significant, but it also illustrates a limitation of relying on one provider to disrupt a multi-model operation: attackers may switch models, use local code or continue with conventional tools.
For defenders, the central lesson is operational. AI can compress reconnaissance, analysis and coordination, but it does not eliminate the need for stolen credentials, vulnerable services or poor access controls.
CARLIY0S Operational Levels (Source : Straiker).
Banks and payment firms should prioritize credential and API-key rotation, least-privilege access, protection of identity and payment systems, and monitoring that connects suspicious activity across accounts, endpoints and applications.
Security teams should also maintain an inventory of AI agents and the tools and data they can reach, and test whether those agents can be misused or made to act beyond their permissions.
CARLIY0S points to a change in how cybercrime can be organized: AI is being used not merely for isolated tasks, but as part of a coordinated attack workflow.
The human operators remain central; the system’s significance is that it may help them work faster and at greater scale.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.