{"description": "Enterprise techniques used by AI-Assisted Breach of Mexico's Government Infrastructure, ATT&CK campaign C0064 (v1.0)", "name": "AI-Assisted Breach of Mexico's Government Infrastructure (C0064)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1087", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to attempt to discover accounts by cycling through relative identifiers (RIDs).(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1098", "showSubtechniques": true}, {"techniqueID": "T1098.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to establish persistence on the system by injecting an SSH key located at `/root/.ssh/authorized_keys` file via a crontab script.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1583", "showSubtechniques": true}, {"techniqueID": "T1583.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary leveraged an attacker controlled Virtual Private Server (VPS) to facilitate C2 and exfiltration actions.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1583.006", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized the legitimate residential proxy provider proxy[.]geonode[.]io for C2 communications.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1595", "showSubtechniques": true}, {"techniqueID": "T1595.002", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to scan an internet-facing server at the Mexico Federal Tax Authority for vulnerabilities using Vulmap.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to scan internet-facing devices to detect vulnerabilities.(Citation: AI-Mexico-Govt-Breach)(Citation: AI-Mexico-Govt-Compromise)    \n \nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary requested Claude Code to use the open-source vulnerability scanner Vulmap to aid in scanning activities.(Citation: AI-Mexico-Govt-Breach) \n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1119", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to automate data extraction jobs across multiple databases as a background process.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1020", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to automatically exfiltrate millions of rows of data, from multiple databases, as comma-separated values (CSV) files to an adversary-controlled virtual private server (VPS).(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1110", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with attempting to brute force SSH connections to systems. (Citation: AI-Mexico-Govt-Breach)", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1110.002", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with cracking database password hashes of the victim organizations.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1110.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to attempt to password spray several database servers.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary has also instructed Claude Code to attempt to password spray a SCADA web interface.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1526", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary identified and connected to victim AWS databases and systems through the use of client tools.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1059", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to create a reverse shell callback on an Amazon Web Services hosted system.(Citation: AI-Mexico-Govt-Breach)\n", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1059.001", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to use `ntlmrelay.py` to execute a base64-encoded PowerShell payload on five domain controllers.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized base64-encoded PowerShell payloads against victim servers.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to execute various commands (e.g., `ls -la`, `nc`, `proxychains4`, etc.) and scripts (e.g., bash, etc.) using the Unix shell.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.006", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with generating and executing numerous Python scripts including [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) to achieve their objectives.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1059.009", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized Cloud APIs for interacting with victim environments and exfiltrating data to include OpenAI\u2019s GPT-4.1 API, and AWS API.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1554", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary requested Claude Code to add a skills file titled claude.md to the project root direct that loads automatically at the start of every Claude Code session.  During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary also routinely updated the skills file to take note of changes and findings.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1555", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary extracted credentials from a database and tested those passwords against victim environments and services.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1213", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to gather and exfiltrate data stored in victim repositories to include sensitive government and civilian records.(Citation: AI-Mexico-Govt-Breach)(Citation: AI-Mexico-Govt-Compromise)  ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1213.006", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary also requested Claude Code to enumerate and collect database schemas, tables containing personal data (names, addresses, phone numbers, FIEL records, etc.), stored procedures, links to additional databases, and database password hashes from victim environments.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with extracting credentials from a database.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1074", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary had Claude Code document select findings in the skills Markdown (MD) file for future recollection.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1587", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized and ingested into the LLM a pre-written document that consisted of techniques and procedures to utilize when set variables and conditions were encountered.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1587.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary used Claude Code to create exploit scripts.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1699", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary abused Claude Code by utilizing a file-write operation within the prompt that created a `claude.md` file that contained a pre-written 1,084-line document containing penetration testing scripts that were used in the campaign.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1585", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary created an account with the legitimate residential proxy provider proxy[.]geonode[.]io.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1190", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to exploit a vulnerability in an internet-facing server at the Mexico Federal Tax Authority to achieve remote command execution.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with planting a webshell on the victims public-facing portal.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1210", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with attempting to exploit the EternalBlue vulnerability.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1083", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to use the `ls -la` command to list files and directories in the current working directory.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1187", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with attempting to use PetitPotam and Printerbug as NTLM relay attacks.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1592", "showSubtechniques": true}, {"techniqueID": "T1592.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to collect information about the victim environments including diagrams, database tables, authentication flow, and configuration files with credentials.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1683", "showSubtechniques": true}, {"techniqueID": "T1683.001", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to generate forged tax compliance certificates with the data collected by custom python scripts.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.006", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary had Claude Code utilize `touch` to keep original timestamps of files in attempts to evade detection.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1105", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary had instructed Claude Code to utilize vulnerability tools to include PetitPotam which Claude Code sought to download to utilize in the victim environment.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1036", "showSubtechniques": true}, {"techniqueID": "T1036.001", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary also forged digital signatures of tax documents using a combination of 96 byte padded SHA-256 hash and base64-encoding resemble a legitimately signed PDF file.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1046", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary instructed Claude Code to use [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) to enumerate ports on victim devices and fed it into OpenAI\u2019s GPT-4.1 API for analysis along with other system information.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1027", "showSubtechniques": true}, {"techniqueID": "T1027.010", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary had Claude Code use base64-encoded PowerShell scripts.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1027.013", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to base64-encode the exploit payload to avoid character restrictions.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1588", "showSubtechniques": true}, {"techniqueID": "T1588.002", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized publicly available tools to include the open-source vulnerability scanner Vulmap.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1588.007", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary obtained access to Claude Code and OpenAI GPT-4.1 AI in order to facilitate attacks against the victim.(Citation: AI-Mexico-Govt-Breach)(Citation: AI-Mexico-Govt-Compromise) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003", "showSubtechniques": true}, {"techniqueID": "T1003.002", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary had Claude Code leverage secretsdump to gather and test passwords.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary requested Claude Code to use secretsdump.py against the victims Active Directory.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary requested Claude Code to utilize secretsdump to obtain LSA secrets.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003.005", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to use secretsdump.py against the victims Active Directory to gather credentials.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003.006", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary requested Claude Code gather credentials against the victim environment and Claude Code utilized `DCSync` to pull password data from the Active Directory.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1003.008", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with extracting the root password hash from the `/etc/shadow` file within the victim server.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1057", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to use [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) to enumerate the processes running on victim systems and fed it into OpenAI\u2019s GPT-4.1 API for analysis along with other system information.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1572", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary instructed Claude Code to connect to the victim devices through SSH tunnels.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary also utilized Chisel SOCKS proxies.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1090", "showSubtechniques": true}, {"techniqueID": "T1090.001", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized Claude Code to maintain access to the victim\u2019s internal network through proxy tunnels.(Citation: AI-Mexico-Govt-Breach)(Citation: AI-Mexico-Govt-Compromise) \n \nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to connect to the internal victim devices through SSH tunnels.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1090.002", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to utilize a residential proxy including `us[.]proxy[.]geonode[.]io` using port 9000.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to connect through a SOCKS proxy, that traversed an internet-facing server, to authenticate to victim hosts over SSH.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1682", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary used Anthropic\u2019s Claude Code and OpenAI\u2019s GPT-4.1 AI to conduct operations.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1021", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with attempting to connect to other systems via FTP.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1021.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to identify SSH connections, make attempts to move laterally within the victim environment, and communicate through SSH tunnels.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1018", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary used Claude Code to request [BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) to perform remote system discovery mapping harvested credentials to systems within the victim environment.(Citation: AI-Mexico-Govt-Breach) \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with enumerating additional lateral movement targets which included the discovery of a vNode industrial gateway and Supervisory Control and Data Acquisition (SCADA)/Industrial Internet of Things (IIoT) management platform.(Citation: AI-Mexico-Govt-Compromise)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1014", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with generating and executing rootkits.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1053", "showSubtechniques": true}, {"techniqueID": "T1053.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to escalate privileges by modifying a crontab script to inject an SSH key into root\u2019s `authorized_keys` file and then restore the file modification time, so the crontab script appeared unchanged.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1505", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary had Claude Code discover and utilize pre-established stored procedures to query the victim database.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1505.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with planting a webshell on SADM\u2019s public-facing portal .(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1082", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to identify system information using `hostname`.(Citation: AI-Mexico-Govt-Breach) \n \n\nDuring the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with using [CrackMapExec](https://attack.mitre.org/software/S0488) to discover configuration information about the domain controllers.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1016", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary leveraged Claude Code to enumerate network devices to include Domain Controllers using the `nslookup` command.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1033", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized Claude Code to discover the user details through `whoami`.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1552", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code with attempting to search for credentials through the webshell.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1552.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized Claude Code to gather data within bash histories.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1552.004", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to harvest credentials and SSH keys from victim systems.(Citation: AI-Mexico-Govt-Breach)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1078", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to leverage compromised valid credentials to authenticate to victim hosts and services.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "showSubtechniques": true}, {"techniqueID": "T1078.003", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary tasked Claude Code to connect to the victim environments using compromised local accounts to include root and service accounts.(Citation: AI-Mexico-Govt-Compromise) ", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1102", "comment": "During the [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064), the adversary utilized a legitimate residential proxy provider for C2 communications.(Citation: AI-Mexico-Govt-Breach) ", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by AI-Assisted Breach of Mexico's Government Infrastructure", "color": "#66b1ff"}]}