Straiker investigation of CyberCartel CARLIY0S agent attack infrastructure

Evidence record

Original vendor analysis of recovered attacker infrastructure and claimed multi-model operations, not independent confirmation of each target compromise.

Read the original source ↗

Claim-level citations (4)

• supportsCARLIY0S orchestrated commercial AI models in a reported Latin American financial attack operation: Straiker reports accessing a September 24, 2026 FinancialSoft snapshot with 4,493 records collected by five Grok miners; the figure counts stored records, not verified unique compromised institutions.

  FinancialSoft database snapshot and September 24 discussion

• supportsCARLIY0S orchestrated commercial AI models in a reported Latin American financial attack operation: Straiker reports a four-model CARLIY0S orchestration system used to target more than 400 Latin American financial organizations, where targets are not a confirmed breach count.

  Signal Check; From APT to AiPT

• supportsCARLIY0S orchestrated commercial AI models in a reported Latin American financial attack operation: Straiker describes a September 24 FinancialSoft snapshot with 4,493 mixed records, including 2,911 email addresses and 903 account numbers.

  From APT to AiPT; FinancialSoft snapshot

• supportsCARLIY0S orchestrated commercial AI models in a reported Latin American financial attack operation: Straiker attributes shared model roles and a PentAGI-backed graph workflow to CyberCartel, based on observed or recovered infrastructure.

  Attack system architecture; model roles