Loading threat actor…
RECKLESS-1 is a designation for a Pegasus spyware operator linked to the Mexican government. The actor has been associated with targeted surveillance operations against Mexican civil society, especially journalists and people connected to sensitive reporting on corruption, organized crime, and public-interest issues. Reported victims linked to this operator include journalists at Río Doce and the widow of murdered journalist Javier Valdez shortly after his assassination in 2017. The actor’s operations relied on spearphishing via SMS messages crafted around highly contextual and emotionally manipulative lures, including breaking-news themes, investigative developments, banking alerts, romantic content, and messages exploiting grief after a killing. The objective was to induce targets to click exploit links that would deploy NSO Group’s Pegasus spyware on mobile devices. Pegasus is capable of covert device compromise and subsequent surveillance, including access to communications, photos, location data, and activation of microphones and cameras. Activity attributed to RECKLESS-1 forms part of the broader documented misuse of Pegasus in Mexico against journalists, human rights defenders, lawyers, investigators, health advocates, scientists, politicians, anti-corruption activists, and other members of civil society. Reporting tied this operator’s infrastructure to multiple infection attempts in 2016 and 2017, and Mexican government-linked Pegasus operations were assessed to have remained active into 2018. The actor is best understood as a government-linked surveillance operator conducting targeted initial access and post-compromise monitoring in support of espionage against domestic civil-society targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pegasus spyware operator linked to the Mexican government that targeted journalists, civil society members, and associates of slain journalist Javier Valdez using malicious SMS messages containing Pegasus exploit links.
A Mexico-linked Pegasus operator accused of abusive spyware targeting against journalists, lawyers, activists, investigators, public health practitioners, and politicians in Mexico, including infection attempts against Río Doce staff after the killing of Javier Valdez Cárdenas.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.