Agent Tesla LATAM Operation — 18-Month Credential Theft Campaign Against Chilean Enterprises via .NET Reactor 6.x Loader & aspnet_compiler.exe Process Hollowing
Agent Tesla LATAM Operation (TL-2026-0525), also tracked as LATAM Under Siege, is a high-severity malware campaign, first published 2026-05-18. It has no confirmed attribution, affects Microsoft Windows, maps to 22 MITRE ATT&CK techniques (T1016, T1027, T1041), and is covered by 9 detection rules and 36 indicators of compromise.
Key facts for TL-2026-0525
- Threat ID
- TL-2026-0525
- Also known as
- LATAM Under Siege, Agent Tesla Chile Campaign, horeca-bucuresti FTP cluster
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-18
- Last reviewed
- 2026-05-18
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- finance, procurement, accounts payable, manufacturing, b2b enterprise, logistics
- Target regions
- Chile, Latin America, South America
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in Agent Tesla LATAM Operation
Malware and tooling: Agent Tesla, .NET Reactor 6.x (Eziriz)
Persistent Agent Tesla credential-theft operation against Chilean and broader LATAM enterprises, active since mid-2024 with 80+ correlated samples. Spanish-language procurement/payroll lures deliver a JScript-encoded dropper that chains to a PowerShell stager, then to a .NET Reactor 6.x protected ALTERNATE.dll loader that AES-256-CBC + Deflate decrypts Agent Tesla and Process-Hollows it into aspnet_compiler.exe. Harvested credentials from 80+ applications are exfiltrated as cleartext HTML reports over FTP to compromised Romanian infrastructure (ftp.horeca-bucuresti.ro).
How Agent Tesla LATAM Operation works
ANY.RUN researcher Moises Cerqueira (2026-05-14) disclosed a sustained Agent Tesla campaign targeting Chilean enterprises and adjacent LATAM organizations across finance, procurement, accounts payable, and B2B verticals. The operator infrastructure — anchored on the compromised Romanian hospitality domain horeca-bucuresti.ro — has been active since at least mid-2024, with more than 80 distinct samples observed communicating with the same FTP credentials over an 18+ month window. The campaign weaponizes Agent Tesla, a commercial .NET keylogger/infostealer in continuous distribution since 2014, behind a hardened delivery and execution chain designed to defeat static AV, sandboxed analysis, and on-disk endpoint inspection.
Initial access is via Spanish-language spear-phishing emails carrying RAR archives that masquerade as purchase orders, payroll, and payment receipts (e.g., ''Orden de compra_pdf.uu'', ''Nómina de sueldos.pdf_008.exe'', ''Comprobante de pago.pdf.exe''). Upon extraction, a JScript-encoded (.jse) dropper executes under wscript.exe, drops randomized-name PowerShell stagers to C:\Temp\ (observed names AYRMWWFH.ps1, Z2KBLYG5.ps1, ELHYLTLT.ps1), and opens a decoy PDF for victim plausibility. The PowerShell stager launches with ExecutionPolicy Bypass and reflectively loads ALTERNATE.dll — a .NET assembly protected by Eziriz .NET Reactor 6.x with control-flow obfuscation, calls encryption, virtualization, and anti-ILDASM tampering enabled.
ALTERNATE.dll extracts an embedded encrypted resource representing the Agent Tesla payload. Decryption uses RijndaelManaged in CBC mode with a 256-bit key, the 16-byte IV prepended to the ciphertext; the plaintext is then decompressed via DeflateStream. Four AES key candidates have been recovered across samples (SHA-256: D5B7247C…, C61B1941…, C356AFF1…, F1C3EBE7…), enabling deterministic offline decryption of additional samples that reuse the loader.
Execution then pivots to Process Hollowing of the trusted Microsoft binary aspnet_compiler.exe (the ASP.NET precompilation utility, signed and present on every modern .NET-equipped Windows host). The loader spawns aspnet_compiler.exe in a suspended state, calls ZwUnmapViewOfSection to evict its image, VirtualAllocEx-allocates RWX memory at the original base, WriteProcessMemory-writes the decrypted Agent Tesla image, SetThreadContext-rewires the entry point, and ResumeThread to detonate. After hollowing, Agent Tesla runs fileless inside a Microsoft-signed process, defeating image-load and signature-based controls and evading EDR rules that whitelist Microsoft binaries.
Before exfiltration, Agent Tesla performs a sandbox/hosting fingerprint by GET-ing http://ip-api.com/line/?fields=hosting and parsing the boolean response — if the host is flagged as a hosting provider (typical of sandboxes and VMs), payload activity is suppressed. On real victims, Agent Tesla harvests credentials from 28+ browsers (Chrome, Edge, Firefox, Brave, Opera and forks), 21+ email clients (Outlook, Thunderbird, IncrediMail, eM Client), 9 FTP clients (FileZilla, WinSCP, CoreFTP, FlashFXP), 5 VPN clients (NordVPN, OpenVPN, Private Internet Access), 13 VNC servers, and 8+ messaging applications (Pidgin, Trillian, Psi). It also runs a polling keylogger, clipboard hijacker, and periodic screenshot capture.
Collection output is serialized into an HTML report named ''PW_{username}-{hostname}_{YYYY_MM_DD_HH_MM_SS}.html'' and uploaded via cleartext FTP to ftp.horeca-bucuresti.ro using the operator account americas2@horeca-bucuresti.ro on the default FTP port. Because credentials travel unencrypted, the campaign is observable to any on-path network sensor that decodes FTP. Mutexes ''roSkM'' (primary) and ''hdfzpysvpzimorhk'' (secondary) and the campaign tag ''HnJnO'' anchor cross-sample clustering, and the persistence binary 7bcd610d-7af6-4dc2-875b-dc4fec91463c.exe has been observed as a recurring artifact.
The campaign''s operational discipline — 18-month infrastructure reuse, professional Spanish-language lures aligned to Chilean accounting cycles (e.g., ''Nomina_Sept2025_Confidencial.xlam'', ''OC 20240814.xlam''), and modular swapping of loaders while preserving FTP credentials — indicates an established criminal operator monetizing credential dumps for downstream BEC, banking-trojan reseeding, and access brokering against LATAM B2B targets.
MITRE ATT&CK techniques used in TL-2026-0525
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Execution
T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1204 User Execution
Credential Access
T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Collection
T1113 Screen Capture; T1114 Email Collection; T1115 Clipboard Data
Initial Access
Affected products and versions in Agent Tesla LATAM Operation
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Microsoft — .NET Framework (aspnet_compiler.exe abused as host process)
Vulnerable versions: all versions shipping aspnet_compiler.exe
Remediation for Agent Tesla LATAM Operation
Immediate actions
- Block FTP egress to ftp.horeca-bucuresti.ro and all *.horeca-bucuresti.ro hostnames at perimeter and DNS resolvers
- Block outbound TCP/21 to non-approved destinations enterprise-wide; FTP cleartext exfil is the primary observable
- Hunt for HTTP GET to ip-api.com/line/?fields=hosting from endpoints (sandbox-fingerprint signature)
- Hunt aspnet_compiler.exe with parent PowerShell or wscript.exe across EDR — this is the Process Hollowing tell
- Quarantine and image any host that previously executed files from C:\Temp\*.ps1 with randomized 8-char names
- Force password rotation for users on suspected hosts (browsers, email, FTP, VPN, VNC credentials are stolen)
Workarounds
- Disable Windows Script Host: HKLM\Software\Microsoft\Windows Script Host\Settings\Enabled = 0
- Application allowlist aspnet_compiler.exe to only run from %WINDIR%\Microsoft.NET\Framework{64}\* and only with developer accounts
Longer-term hardening
- Deploy EDR with behavioral Process Hollowing detection (suspended-thread image replacement)
- Enable PowerShell Script Block Logging (EID 4104) and ScriptBlockText capture; alert on ExecutionPolicy Bypass and reflective Assembly.Load
- Enforce wscript.exe / cscript.exe blocking via WDAC or AppLocker for non-administrative users
- Deploy ASR rule ''Block JavaScript or VBScript from launching downloaded executable content'' (D3E037E1-3EB8-44C8-A917-57927947596D)
- Disable .jse handler association for the WSH on workstations that have no legitimate use
- Block RAR/uncommon-archive attachments at email gateway or detonate in sandbox before delivery
- Deploy network detection rules for FTP PUT of PW_*.html filename pattern
Weaknesses (CWE) in Agent Tesla LATAM Operation
CWE-94, CWE-913, CWE-319
Timeline of Agent Tesla LATAM Operation
- Agent Tesla first appears for sale as a commercial .NET keylogger/credential stealer; in continuous distribution since.
- Earliest correlated samples observed uploading to ftp.horeca-bucuresti.ro using operator account americas2@horeca-bucuresti.ro (~mid-2024).
- Spanish-language Chilean procurement lure ''OC 20240813.xlam'' first observed in distribution.
- Companion lure ''OC 20240814.xlam'' observed, demonstrating same-week LATAM procurement-themed mass distribution.
- Payroll-themed lure ''Nomina_Sept2025_Confidencial.xlam'' observed, confirming 14+ month campaign continuity.
- ANY.RUN interactive sandbox task 54d00d6d-e6d0-4f54-8907-a571a293127b captures end-to-end chain including aspnet_compiler.exe hollowing and FTP exfil.
- ANY.RUN publishes Moises Cerqueira''s research; Malpedia ingests; 80+ correlated samples disclosed (18+ months active, mid-2024 onward).
- Threadlinqs Intelligence publishes threat record TL-2026-0525 with full MITRE mapping, IOCs, and detection coverage.
- As of 2026-05-29, this Agent Tesla LATAM/Chile credential-theft campaign remains an active, live threat: ANY.RUN (disclosed 2026-05-14, latest detonation 2026-03-27), Broadcom, and Fortinet corroborate ongoing activity, with the compromised ftp.horeca-bucuresti.ro FTP infrastructure reused 18+ months and no reported takedown, sinkhole, or arrest. The unattributed financial operator and commodity Agent Tesla tooling both persist, so the technique and infrastructure stay viable.
Sources cited for Agent Tesla LATAM Operation
- LATAM Under Siege: Agent Tesla's 18-Month Credential Theft Campaign Against Chilean Enterprises
- Malpedia entry — LATAM Under Siege: Agent Tesla
- ANY.RUN Interactive Sandbox detonation (task 54d00d6d-e6d0-4f54-8907-a571a293127b)
- Malpedia — Agent Tesla family overview
- MITRE ATT&CK — Process Hollowing (T1055.012)
- MITRE ATT&CK — Software: Agent Tesla (S0331)
- Eziriz .NET Reactor product documentation
Threats related to Agent Tesla LATAM Operation
- DesckVB RAT — Google DoubleClick-Abusing Malspam Kit Delivers Fileless .NET Remote Access Trojan (Huntress)
- DarkCloud Infostealer — Commercial VB6 Credential-Harvesting Malware (A310Logger/BluStealer Successor)
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
- Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
- Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email Spreader
- JavaScript-Driven PureLogs Infostealer Variant Delivered via Purchase-Order Phishing with Process Hollowing into MsBuild.exe
Detection coverage for TL-2026-0525
As of 2026-05-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0525 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.