# Agent Tesla LATAM Operation — 18-Month Credential Theft Campaign Against Chilean Enterprises via .NET Reactor 6.x Loader & aspnet_compiler.exe Process Hollowing

> Persistent Agent Tesla credential-theft operation against Chilean and broader LATAM enterprises, active since mid-2024 with 80+ correlated samples. Spanish-language procurement/payroll lures deliver a JScript-encoded dropper that chains to a PowerShell stager, then to a .NET Reactor 6.x protected ALTERNATE.dll loader that AES-256-CBC + Deflate decrypts Agent Tesla and Process-Hollows it into aspnet_compiler.exe. Harvested credentials from 80+ applications are exfiltrated as cleartext HTML reports over FTP to compromised Romanian infrastructure (ftp.horeca-bucuresti.ro).

- **Published:** 2026-05-18T12:00:00Z
- **Last reviewed:** 2026-05-18T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0525
- **ID:** TL-2026-0525
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ANY.RUN researcher Moises Cerqueira (2026-05-14) disclosed a sustained Agent Tesla campaign targeting Chilean enterprises and adjacent LATAM organizations across finance, procurement, accounts payable, and B2B verticals. The operator infrastructure — anchored on the compromised Romanian hospitality domain horeca-bucuresti.ro — has been active since at least mid-2024, with more than 80 distinct samples observed communicating with the same FTP credentials over an 18+ month window. The campaign weaponizes Agent Tesla, a commercial .NET keylogger/infostealer in continuous distribution since 2014, behind a hardened delivery and execution chain designed to defeat static AV, sandboxed analysis, and on-disk endpoint inspection.

Initial access is via Spanish-language spear-phishing emails carrying RAR archives that masquerade as purchase orders, payroll, and payment receipts (e.g., ''Orden de compra_pdf.uu'', ''Nómina de sueldos.pdf_008.exe'', ''Comprobante de pago.pdf.exe''). Upon extraction, a JScript-encoded (.jse) dropper executes under wscript.exe, drops randomized-name PowerShell stagers to C:\Temp\ (observed names AYRMWWFH.ps1, Z2KBLYG5.ps1, ELHYLTLT.ps1), and opens a decoy PDF for victim plausibility. The PowerShell stager launches with ExecutionPolicy Bypass and reflectively loads ALTERNATE.dll — a .NET assembly protected by Eziriz .NET Reactor 6.x with control-flow obfuscation, calls encryption, virtualization, and anti-ILDASM tampering enabled.

ALTERNATE.dll extracts an embedded encrypted resource representing the Agent Tesla payload. Decryption uses RijndaelManaged in CBC mode with a 256-bit key, the 16-byte IV prepended to the ciphertext; the plaintext is then decompressed via DeflateStream. Four AES key candidates have been recovered across samples (SHA-256: D5B7247C…, C61B1941…, C356AFF1…, F1C3EBE7…), enabling deterministic offline decryption of additional samples that reuse the loader.

Execution then pivots to Process Hollowing of the trusted Microsoft binary aspnet_compiler.exe (the ASP.NET precompilation utility, signed and present on every modern .NET-equipped Windows host). The loader spawns aspnet_compiler.exe in a suspended state, calls ZwUnmapViewOfSection to evict its image, VirtualAllocEx-allocates RWX memory at the original base, WriteProcessMemory-writes the decrypted Agent Tesla image, SetThreadContext-rewires the entry point, and ResumeThread to detonate. After hollowing, Agent Tesla runs fileless inside a Microsoft-signed process, defeating image-load and signature-based controls and evading EDR rules that whitelist Microsoft binaries.

Before exfiltration, Agent Tesla performs a sandbox/hosting fingerprint by GET-ing http://ip-api.com/line/?fields=hosting and parsing the boolean response — if the host is flagged as a hosting provider (typical of sandboxes and VMs), payload activity is suppressed. On real victims, Agent Tesla harvests credentials from 28+ browsers (Chrome, Edge, Firefox, Brave, Opera and forks), 21+ email clients (Outlook, Thunderbird, IncrediMail, eM Client), 9 FTP clients (FileZilla, WinSCP, CoreFTP, FlashFXP), 5 VPN clients (NordVPN, OpenVPN, Private Internet Access), 13 VNC servers, and 8+ messaging applications (Pidgin, Trillian, Psi). It also runs a polling keylogger, clipboard hijacker, and periodic screenshot capture.

Collection output is serialized into an HTML report named ''PW_{username}-{hostname}_{YYYY_MM_DD_HH_MM_SS}.html'' and uploaded via cleartext FTP to ftp.horeca-bucuresti.ro using the operator account americas2@horeca-bucuresti.ro on the default FTP port. Because credentials travel unencrypted, the campaign is observable to any on-path network sensor that decodes FTP. Mutexes ''roSkM'' (primary) and ''hdfzpysvpzimorhk'' (secondary) and the campaign tag ''HnJnO'' anchor cross-sample clustering, and the persistence binary 7bcd610d-7af6-4dc2-875b-dc4fec91463c.exe has been observed as a recurring artifact.

The campaign''s operational discipline — 18-month infrastructure reuse, professional Spanish-language lures aligned to Chilean accounting cycles (e.g., ''Nomina_Sept2025_Confidencial.xlam'', ''OC 20240814.xlam''), and modular swapping of loaders while preserving FTP credentials — indicates an established criminal operator monetizing credential dumps for downstream BEC, banking-trojan reseeding, and access brokering against LATAM B2B targets.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1055 Process Injection
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218 System Binary Proxy Execution
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1115 Clipboard Data
- T1113 Screen Capture
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [LATAM Under Siege: Agent Tesla's 18-Month Credential Theft Campaign Against Chilean Enterprises](https://any.run/cybersecurity-blog/agent-tesla-latam-enterprise/)
- [Malpedia entry — LATAM Under Siege: Agent Tesla](https://malpedia.caad.fkie.fraunhofer.de/library/7ada9037-fddf-4c97-b408-b8de42b39f6d/)
- [ANY.RUN Interactive Sandbox detonation (task 54d00d6d-e6d0-4f54-8907-a571a293127b)](https://app.any.run/tasks/54d00d6d-e6d0-4f54-8907-a571a293127b)
- [Malpedia — Agent Tesla family overview](https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla)
- [MITRE ATT&CK — Process Hollowing (T1055.012)](https://attack.mitre.org/techniques/T1055/012/)
- [MITRE ATT&CK — Software: Agent Tesla (S0331)](https://attack.mitre.org/software/S0331/)
- [Eziriz .NET Reactor product documentation](https://www.eziriz.com/reactor.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0525