Mexican Mafia
Mexican Mafia is a suspected hacktivist threat actor that CloudSEK also refers to as Pancho Villa. CloudSEK attributed Operation Escaneo to this group with medium confidence. The campaign primarily targeted government, financial, and critical infrastructure organizations in Latin America, especially Mexico, with additional activity observed in Ecuador and Portugal. Targeted sectors included government, tax authorities, utilities, transport, telecommunications, and banks. According to the provided reporting, the group spent 2024 claiming breaches against Mexican government, judicial, and energy targets, sometimes framing the intrusions as protest, although some of those claims were disputed by the named organizations. In Operation Escaneo, the actor used internet-facing security appliances for initial access, including Fortinet FortiOS SSL-VPN vulnerabilities CVE-2022-42475 and CVE-2024-21762, and Ivanti Connect Secure vulnerabilities CVE-2023-46805, CVE-2024-21887, and CVE-2025-0282. The group also possessed exploits for GhostCat, EternalBlue, Zerologon, and Log4Shell. Observed tradecraft included a custom reconnaissance engine called Kimera, Neo-reGeorg webshells, Chisel reverse tunnels over HTTP, and a compromised Cisco router configured with a GRE tunnel to attacker infrastructure. The actor accessed SAP and Oracle systems to execute commands and conducted large-scale data theft, including more than 1.3 million personal records from one transport provider, a 407MB Active Directory map, SSL private keys, SAP service-account hashes, and browser-stored passwords. The content also states that in March 2026 the group underwent structural changes by merging with Mexican Mafia Team to form Chronus Mafia.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Associated vulnerabilities
8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.
Its reach went well beyond perimeter gear, with exploits for Apache Tomcat's GhostCat flaw, the Windows bugs EternalBlue and Zerologon and Log4Shell.
Its reach went well beyond perimeter gear, with exploits for Apache Tomcat's GhostCat flaw, the Windows bugs EternalBlue and Zerologon and Log4Shell.
Its reach went well beyond perimeter gear, with exploits for Apache Tomcat's GhostCat flaw, the Windows bugs EternalBlue and Zerologon and Log4Shell.
The group kept tuned exploits for Fortinet FortiOS SSL-VPN flaws, including CVE-2022-42475 and CVE-2024-21762, adapting public proof-of-concept (PoC) code so it would not crash the target.
The group kept tuned exploits for ... Ivanti Connect Secure flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282, adapting public proof-of-concept (PoC) code so it would not crash the target.
3 more CVEs tied to this actor tracked in Mallory.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named group referenced as merging with Chronus Team to form Chronus Mafia.
A suspected hacktivist-linked group that allegedly claimed breaches against Mexican government, judicial, and energy targets and was attributed with medium confidence to Operation Escaneo.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.