The groups operate in Chinese, Spanish and English, Indonesian, and Russian.
All four left their AI infrastructure openly accessible on web servers, which let investigators see their activity and the models they used, mostly versions of Anthropic's Claude and the open-weight Deepseek models.
CrowdStrike found that all four got around the models' safeguards, often by convincing them the work was authorized security testing.
The Chinese-speaking actor compromised government targets in Brazil and Colombia and went after private organizations in Brazil and the United States across sectors including biotech, healthcare, and retail.
The Spanish- and English-speaking actor breached at least 15 Argentine health care organizations, and CrowdStrike sees evidence it stole credentials and medical records from at least one.
The Indonesian- and Russian-speaking actors, which used more basic publicly available tools, still compromised targets, including Indonesian and Bangladeshi government domains.
CrowdStrike's Adam Meyers said the attacks used no new exploits. Instead, they used AI's speed and volume to exploit common, preventable security hygiene problems. The attackers mixed older open- and closed-weight models, partly to control costs and partly because guardrails differ between models, even from the same company. Tactics included planting files to suggest tasks were approved, using jailbreak-style prompts, and, in the Chinese-speaking case, a tool called ClawGod that tried to strip an instruction limiting Claude Code to authorized testing. Meyers said humans typically do initial probing and then hand off to AI for hacking at scale. Anthropic did not comment before publication, and Deepseek did not immediately respond to WIRED.