I went to check the CARLYOS report: four Claudes had a meeting, and refused to change the local code.

Let's start with the results:It's true that Straiker sent a complete report on October 21, evidence from his own server.But when I went to the originals, I found out that the title "400 financial institutions have been broken down" and the original text of the report was not correct: "attack over 400 financial documents,"There's 400 targets, not 400.I don't know. They're not too different.

I spent two hours chewing that report from head to tail and flipping it twice in the middle: The first was to reproduce the part of CrowdStrike and DeepSeek, which was not in the report; the second was to look for the original origin of the 400 families that had been broken, which could not be found, and the last confirmation was that the transliteration turned the targets into the "break."

So, if you don't blow it, just tell me what I've identified — including how this group works, what's real and what's media.

First, find out who this gang is.

The subject named in the report is as follows:

• CyberCartelThe activities of cybercrime gangs in Mexico can be traced back to 2012, with long-term attacks on the Latin American financial system.
• Tr4nsHack TeamOther Organiser AiPT-67(AiPT = AI-powered Persistent Threat, corresponding to traditional APT)
• Hexagon Security Labs Mexico: The name of the shell company used to hide itself in a "safe lab".
• CARLYOSThe multi-smart attack system they put together, the main character.

The context in which the group deserves to be singled out is that it's not the kind of script that suddenly emerges.The business understandings that have survived the financial system for more than a decade — the internal flow of the bank, the reconciliation of the payment gateway, the targeting of the wind — are prerequisites for the system to run.The model just raised their speed, not taught them how to rob banks from zero.

This is a key point. If you think you can do anything with an AI, you lower the threshold. The real threshold has always been understood in the business, and AI is responsible for turning "understanding" into "output" by hand.

Two or four Claude, division of labour, one board.

This part of the report is the best place for me to look at the whole report — not so much technology, but so much engineering.

The heart of the system is called "Commander." Cursor IDE In it, it's basically a man who knocks in an AI editor and calls. CARLIY0S.py Script. Scripts to transfer the Anthropic API to the sub-intelligence of four fixed characters:

Code	Back model	What?
STRIKER	claude-opus-4-7	Direct execution: writing code, writing usage, writing automated scripts without reference to authorized background
GHOST	claude-opus-4-8	Reconnaissance analysis: OSINT Verification, Infrastructure Identification, Hidden Path
FABLE	claude-fable-5(not confirmed)	Horizontal thinking: Business logic gaps, unconventional approaches
MAXIMUS	claude-opus-5	Final arbitration: returning to a "key decision" on the outcome of the debate

Watch the smartest step in this design:Instead of having a model come up with a formula, the three players would be detached from each other, and the fourth referee would take over.

That is what the report says — to allow them to cross-check each other, to criticize each other's payloads, to sharpen their tactics so as to overcome the illusions and logical errors that occur when individual models fight alone.

To be honest, it's a "multi-model debate" that's used as a noise abatement. It's easy for a single model to walk into the dark, with three different roles, and it's possible to find out where each other is.

There is one more detail to mark:Fablee, that. claude-fable-5 It's just in the profile. The report says there's no proof it's been successfully called. Pass.So this is unproven. Anthropic's threat report in September also stated that they were dealing with cyber attacks that did not involve Fable or Mythos models.

In three or six stages, someone starts with a sentence.

The whole process was split in six steps, and I reordered it in the following order:

Phase I: Reconnaissance

GHOST runs OSINT, flips open information, employee social accounts, historical data leaks, and puts out the attack face. No specific tool chain was provided in the report, but this was an open information project, which was not difficult.

Phase II: Debate

Three players took the context of the target and started to spray each other, and MAXIMUS drew a conclusion.This step is not a report, it is a multi-state code for direct implementation—— —— —— —— —— —— —— —— —— 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。 。

Phase III: Go online

This step is where the technology is really high. The attackers didn't use naked HTTP requests -- that kind of WAF could see at first sight. They use it. Playwright Control No Head ChromiumFrom SOCS5 TunnelGet out. Go. Housing agent for IP BurgerI don't know.

The headless browser renders pages, executes JS, simulates real people, points in CMS, with almost no difference between behavioral characteristics and real person views.

Phase IV: Access to power

The goal is... Magnolia CMS Backstage. After authentication, the program automatically injects a high degree of confusion into the front end of Vaadin. Groovy scriptGet the RCE.

Then there's the detail that I appreciate:It removes the session cookie from the browser and inserts it directly into a pure Python Requests environmentI don't know. The browser is only used to break the door and throw it when it's done, and all of it is followed by light requests to run — fast, steady and not easily followed by the browser's detection mechanism.

Phase 5: Spread out

The injection of RCE triggers three automated loads:

• Victor A.: scan the Oracle database, listing users, roles, views, preparation for the trailer.
• Victor B.: Turn the file system to JDBC connection and SSH private key, even if the defense has filled the CMS loophole, it can return with these certificates.
• Victor C.: Scanning the Intranet section (for example, 172.30.2.x in the report), using the hit Web server as a springboard and looking for a lower backstage.

Phase 6: Harvest

Five "Grok Miner" picks up the keys, the account numbers, and calls from one of them. FinnishSoft Couric move.

From phase I to phase VI, one thing is done:Write the target at the beginningI don't know. That's what the word "full auto" means -- not AI to knock on a few lines for you, you quit the loop.

iv. Things that have been turned out are more specific than the title.

Straiker got a snapshot of FinancialSoft on September 24, 2026. This is the group's own evidence base, not speculation, but reality.

Category	Number	What does that mean?
Total number of documents recorded	4,493	Size of the entire library
Mailbox Address	2,911	It's almost full.
CLABE Account Number	903	Mexican standard bank account number. It's a direct account.
Gap report with day 0	200+	From May to September 2026, the true loophole from the injured party
Universal API Key	391	Interface Level Access
Password / Portal Login	67 / 51	The one that works directly.
JWT Signing Key	20	It's a fake token. It's too much.
Keycloak certificate	20	Identity provider level control
The clear back door.	6	Include master password bypassing, sharing root accounts

This group is most visible:Forty-three documents for a financial technology victim, 11 of them API Key, 32 encryption keys.This scale was reported to be sufficient to abuse SPEI - Mexico's cross-line payment system.

With 903 CLABE accounts and 20 JWT signing keys, this is no longer a "stolen data" .This is the key to the payment tunnel and the ID.I don't know.

The report refers, by the way, to 19 more documents from Wasabi S3 and 15 from Mailgun. The former is data storage, the latter meansWe can use the legal mail infrastructure to send fish e-mails.And the next round of attacks has ammunition.

V. The part about the security strategy is the most appropriate one in the report.

The biggest obstacle to running is not technology, but model incompatibilities.

The attackers used both hands. They were simple but effective:

First hand: wrap "I'm attacking" with "I'm doing an authorization test."

Working environments are defined in their prompt and rule files Done.Authorized Red Team Exercises, Academic Infiltration Tests, Gap Disclosure ProjectI don't know. Under this hypothesis, the model considers all outputs to be compliant defensive deliveries.

The report states that, under this umbrella, the model generates parameters fuzzer, confuses compressed JS, synthesizes the use logic, and none of the manufacturer ' s content filters are triggered.

Second hand: Change the local code for dying.

This hand is worse. They'll let Kimi and SunNET-2 try first.No mistakes, no attempts, just cut. CARLIY0S_consolidated.py– A local document written in advance, full of solid attack codes.

The report calls this "tactical prejudicion": it designs the rejection of models as a foreseeable event, not as a failure.

These two details, taken together, illustrate a uncomfortable situation:The frame of the model has a limited role in the face of a "structure level" confrontation.You can make a single conversation refuse to answer, but you can't stop each other from going the other way after that.

There's one more detail that I think is rather dark: their rules are clear.Disable AI Output Tr4nsHack, the reason is to limit attribution through model outputs. It's called "cognitive OPSEC" - even AI would leave any traces.

Infrastructure: A 61TB server for brain

The center of the system is an Ubuntu server.61TB RAID5♪ running a MCP knowledge map, listening ♪ 8001 Port.

All sub-intellectual bodies must look at this picture before it is implemented — the equivalent of sharing a real-time updated brain across the team and avoiding duplication of effort. Two operators. .cursor/mcp.json Point to the same pattern, the target found by the A machine, the B machine can see immediately.

The synchronous mechanism is also very useful:rsync for 15 minutes.I'm sorry.sync_live.sh♪ With ♪ --compare-destIt's a PowerShell.SetThreadExecutionStatePrevention of hibernation. Backup machines are explicitly banned from cloning complete mirrors because the 1.1TB environment will crush Cursor.

The export was carried out by SOCKS5 to the housing agency pool at IP Burger and Bright Data, to forge local traffic in Mexico and to block and blacklist the IP.

Seven, now the title.

After reading the report, the original version of the figure for "400" reads:Asking over 400 financial disasters in a matter of monthsOver 400 financial targets were attacked in a few months.

“Targets to attack” and “agencies to break down” are two concepts. In the report.No number of successful incursions givenAnd it doesn't say how many of these 400 miles are actually punched through. It gave concrete evidence of the documentary composition of a financial technology victim, a sample of a bank penetration report (numbers have been erased) and the supporting bank of the 4,493.

I don't think it's an exaggeration by Straiker -- the report itself is very restrained, and it specifically says that the victims come together anonymously. It's a transliterated chain where "targets" are replaced by "break."

One more thing needs to be clear:This is a report issued by a company that sells anttic AI safety products.The report does not conflict with its commercial motives, but you have to read it in your heart. It emphasizes that "this is the first complete piece of evidence taken from the aggressor's own work environment" and that I cannot independently verify this "first" statement, but only copy it.

"CrowdStrike confirms that DeepSeek is also being used," I found nothing in Straiker's report. The report calls for models such as Claude (Sonnet and Opus series), XAI Grok, Kimi.DeepSeek, I can't read this, so this isn't written.

VIII. RESPONSES OF ANthropic AND XAI

The report is devoted to a coordination process which I think is worth remembering:

• Anthropic: Got a lead before the release, alreadyThe evidence used to access Claude was revoked.It's like cutting off the whole swarm.
• xAI: notified that the five Grok Miner related activities are being investigated.

The value of this section is that it illustrates one of the weaknesses of such attacks:They depend on commercial API legal accounts.The account number is one, and the whole line is broken. And that's why they've got the local bottom code -- but it's solid enough to use it in real time.

IX. REAL REQUIRED TO CHANGE

I broke the last part of the report into three layers because it said "seven features."

	Traditional APT	AiPT
Who's out of the plan?	People use writing, people pick targets.	Model debates, model utilization
Single cost	Weeks, 100,000.	Marginal costs are approaching zero.
Swallow.	One a day.	Hundreds at the same time.
What determines the ceiling?	Team skills	Level of tool integration
Behavioural characteristics	Fixed script, modem	Real-time adjustment. We'll change course at speed.

The last line is what I think is the worst."Dynamic Adaption" means that your test rules will fail.- It'll slow down when it comes to wind control, when it comes to WAF, it'll change paths, it'll change paths, it's not hard. The rule of fixed thresholds, the blacklist of fixed characteristics, is not a natural match.

So it's these three.

1. Identity Level: The evidence is a fait accompli, so don't count on "preventing". Zero trust, short-time tokens, JWT signature keys rotate on a regular basis, Keycloak, and IdPs of this type are reinforced individually - 20 JWT keys + 20 Keycloaks in the report are based on this combination and are specifically used to forge identity.
2. Behaviour LayerIP blacklists and geographical blockades are largely ineffective against residential agents, and this is what IP Burger and Bright Data do in the report. You can see the operating sequence - the operational rhythm after login, the rationality of the access path, the permission jump in the session.
3. Result Layer: The account takes over and ends up in cash. Multiple factors, large transfers, manual review, unusual transaction interception, these old methods are more valuable in the AI era because they're the result, no matter how you get in.

There's another one for those who use AI anent.

It took a lot of time to say, "How can you protect yourself from people hitting you with al?" But it was the other half:Your own deployment of angent is also a front.

Of the five capabilities recommended in the report, two are specific to this - finding out what angents are in your environment, what they can access, and what can be cut out of control while running.

Translator: If you run a bunch of agents in the company who have access to the system,The risk of the prompt injection and the context of the report is the same.I don't know. The difference is only this time it was your angent, not your opponent.

X. FINAL

I don't want to write "AI makes the attack scary," it's too cheap.

It's not just a model, but...Project completion of the systemSharing of knowledge maps, differential synchronization, rejection of bottom-up, cognitive OPSEC, role division, arbitration mechanisms. None of these are the ones that AI came up with, all of them on the shelf, and AI just put all the work in every cell.

In other words, the gang wins.Make AI a programmable componentNot as a wish pool.

What is the AI approach for most businesses? Buy an interface, pick up a passenger robot, write a weekly paper. This gap is not one of modelling capacity but one of engineering capacity.

The rivals are not "AI", they're the ones who put AI into the process, and they write down the bottom of it.

The original text of the report is available on the Straiker website under the title Inside CARLIY0S: How CyberCartel Used Multipliple AI Models to Attack 400+ Latin American Banks and Financial Institutions. To read the full text, a form has to be filled out, but the blog has written all the technical details.

Finally, the IP report of the central server (157 [...] 180 [...] 98 [...] 220, port 801) is publicly available and has been defang processed. Don't let it go -- it's someone else's evidence, not where you're experimenting.