Threat reportAPTTL-2026-4318
Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions
Operation Escaneo (TL-2026-4318), also tracked as Operation Escaneo, is a high-severity advanced persistent threat campaign, first published 2026-10-23. It is attributed to MexicanMafia with medium confidence, affects Fortinet FortiOS SSL-VPN, references 13 CVEs (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762), maps to 18 MITRE ATT&CK techniques (T1021.002, T1027, T1046), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 13Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 2MexicanMafia
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4318
- Threat ID
- TL-2026-4318
- Also known as
- Operation Escaneo
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- MexicanMafia, PanchoVilla
- Attribution confidence
- MEDIUM
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, telecoms, transport, utilities
- Target regions
- mexico, ecuador, portugal, Latin America
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Operation Escaneo
Malware and tooling: AnyDesk, Kimera, Neo-reGeorg - S1189, SharpHound, Xortigate, BloodHound - S0521, Chisel, ETERNALBLUE, Impacket - S0357, Neo-reGeorg, metasploit
How Operation Escaneo works
CloudSEK analysis of staging-server artifacts (62.171.185.97) attributes, with medium confidence, a 2025-2026 intrusion campaign to MexicanMafia (aka PanchoVilla). The actor used custom frameworks (Kimera V1/V2, Xortigate v2-v4), open-source tooling (Nuclei, Chisel, Neo-reGeorg, Impacket) and exploits against Fortinet, Ivanti, Tomcat, SMB and Log4j, with 1.3M+ PII records, a 407 MB Active Directory dataset and SSL private keys reported exfiltrated.
Operation Escaneo is a 2025-2026 intrusion campaign against Mexican federal agencies, Mexican and Latin American financial institutions, with secondary targeting in Ecuador and Portugal. CloudSEK (report published 2026-06-17) derived the analysis from artifacts exposed on actor staging infrastructure, primarily the operator VPS 62.171.185.97, and attributes the activity with medium confidence to MexicanMafia, also tracked as PanchoVilla. The campaign window confirmed from Chisel session logs is a minimum of 13 days (January 28 to February 10), with 3,708 logged Chisel sessions; CloudSEK assesses this is likely only a fraction of the total access.
Initial access relied on exploitation of internet-facing perimeter and application services: Fortinet FortiOS SSL-VPN (CVE-2022-42475 with a custom stability-tuned variant, CVE-2023-27997 via the 'Xortigate' v2-v4 exploit, CVE-2024-21762), Ivanti Connect Secure (CVE-2023-46805 chained with CVE-2024-21887, and CVE-2025-0282), Apache Tomcat AJP GhostCat (CVE-2020-1938, ajpShooter.py), Log4Shell (CVE-2021-44228, JNDI/LDAP callback listener) and VMware AirWatch (CVE-2022-22972 assessment). The actor also abused Oracle DBMS_SCHEDULER/UTL_FILE, SAP RFC function modules (SXPG_CALL_SYSTEM, SXPG_COMMAND_INSERT), GeoServer WFS injection and PostgreSQL sys_eval for command execution. CloudSEK reports confirmed RCE beacons from at least 5 victim IPs.
A custom reconnaissance engine, Kimera V1/V2, chains subfinder, assetfinder, findomain, dnsx, naabu (5,000 pps), httpx, gowitness, LinkFinder, whatweb, Nuclei and Dalfox into an automated discovery-to-exploitation pipeline. Post-exploitation used a portable Impacket bundle (mini_imp/: psexec, wmiexec, smbexec, secretsdump, GetUserSPNs), Metasploit resource scripts for MS17-010/MS08-067/SambaCry, SMBGhost and Zerologon testers, PwnKit (CVE-2021-4034) for local privilege escalation, Kerberoasting, BloodHound/SharpHound, password spraying scripts and harvested credentials from FortiGate, Cisco, PostgreSQL, MSSQL and Zimbra artifacts.
Persistence and command-and-control were layered: Neo-reGeorg webshells (JSPX/JSP/ASPX/PHP) with AES encryption, custom JSP/PHP webshells, a ZipSlip dropper (mkzip34.py, xpw3.jsp), a Chisel reverse proxy, multi-hop SOCKS5 relays via 165.22.184.26 and proxychains, a GRE tunnel configured over IOS-XE SSH on a compromised Cisco router pointing back to 62.171.185.97, and abuse of AnyDesk and N-able-themed LNK lures. Reported exfiltration includes 1.3M+ Oracle PII records (dump_batch.sh, 100K-row batches), a 407 MB compressed BloodHound Active Directory dataset, Kerberoast hashes, Chrome credential stores, network device configurations and PostgreSQL SSL private keys streamed with Netcat to 62.171.185.97:8888.
Attribution rests on TTP and targeting continuity with historical MexicanMafia/PanchoVilla activity against Mexican government entities (2024 claims include Oaxaca State Police, Mexico City government, UNAM institutes, PEMEX and court systems), plus infrastructure and tooling maturity. CloudSEK notes caveats: some historical breach claims are disputed by victims, and the separate 2025-2026 AI-assisted Mexican government breach reported by Gambit Security was not attributed to this actor. No campaign-level CVSS score is published.
MITRE ATT&CK techniques used in TL-2026-4318
Lateral Movement
T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information
Discovery
T1046 Network Service Discovery
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
Execution
T1059.004 Unix Shell; T1059.008 Network Device CLI
Command and Control
T1090.003 Multi-hop Proxy; T1219 Remote Access Tools; T1572 Protocol Tunneling
Credential Access
T1110.003 Password Spraying; T1552.001 Credentials In Files; T1558.003 Kerberoasting
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Persistence
Resource Development
T1583.003 Virtual Private Server; T1587.001 Malware
Reconnaissance
Affected products and versions in Operation Escaneo
- Fortinet — FortiOS SSL-VPN
Vulnerable versions: Versions affected by CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762 per Fortinet PSIRT
Fixed in: Fixed releases per Fortinet PSIRT advisories - Ivanti — Connect Secure
Vulnerable versions: Versions affected by CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282 per Ivanti advisories
Fixed in: Fixed releases per Ivanti advisories - Apache — Tomcat (AJP connector)
Vulnerable versions: Versions affected by CVE-2020-1938 (GhostCat)
Fixed in: Fixed releases per Apache Tomcat security notes - Microsoft — Windows SMB, SMBv3 and Netlogon
Vulnerable versions: Unpatched systems for MS17-010, MS08-067, CVE-2020-0796, CVE-2020-1206, CVE-2020-1472
Fixed in: Fixed via Microsoft security updates - Polkit — pkexec
Vulnerable versions: Versions affected by CVE-2021-4034 (PwnKit)
Fixed in: Distribution polkit updates - Apache — Log4j
Vulnerable versions: Versions affected by CVE-2021-44228 (Log4Shell)
Fixed in: Log4j fixed releases - VMware — Workspace ONE AirWatch
Vulnerable versions: Versions affected by CVE-2022-22972
Fixed in: Fixed releases per VMware advisory
Remediation for Operation Escaneo
Patches
- FortiOS fixes for CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762
- Ivanti Connect Secure fixes for CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282
- Apache Tomcat fix for CVE-2020-1938
- Microsoft fixes for MS17-010, CVE-2020-0796, CVE-2020-1206 and CVE-2020-1472
- Polkit fix for CVE-2021-4034
- Log4j fix for CVE-2021-44228 and removal of vulnerable commons-collections
- VMware fix for CVE-2022-22972
Immediate actions
- Block 62.171.185.97, 165.22.184.26, 185.65.245.10 and 45.61.137.126 at the perimeter and hunt for historical connections, especially ports 8888, 1389, 1080, 5554, 5571 and 7227
- Audit Cisco IOS-XE devices for unexpected Tunnel/GRE interfaces and TCL scripting, and review SSH sessions followed by tunnel configuration
- Rotate all credentials stored on or reachable from FortiGate, Cisco, PostgreSQL, MSSQL, Zimbra and SAP systems if configs or dumps may have been exfiltrated
- Hunt web roots for unexpected .jsp, .jspx, .aspx and .php files (Neo-reGeorg, status.jsp, ver.jsp, sedema_proc.jsp, xpw3.jsp, shell.php, ws.php, bt.php)
- Audit AnyDesk and N-able deployments and remove unapproved instances
Workarounds
- Disable GeoServer WFS if not required
- Disable Cisco IOS TCL scripting on production routers and restrict management SSH by ACL
- Enable SSL inspection on VPN management interfaces
Longer-term hardening
- Enforce MFA on all VPN, RDP and administrative interfaces
- Disable SMBv1 and block 445/TCP at the perimeter and between segments
- Disable RC4-HMAC Kerberos and remove Group Policy Preferences encrypted passwords
- Segment SAP and Oracle environments and restrict RFC and database port access; restrict DBMS_SCHEDULER privileges and SXPG_CALL_SYSTEM use
- Deploy file integrity monitoring on web server directories and alert on ZIP/WAR archives containing ../ entries
- Monitor TFTP and outbound SOCKS5/Chisel-style proxy behavior for configuration and data exfiltration
CVEs associated with Operation Escaneo
Weaknesses (CWE) in Operation Escaneo
Timeline of Operation Escaneo
- Earliest in CloudSEK's historical attribution context: breach of the Oaxaca State Police (March 2024; month-level date). Later 2024 claims include Mexico City government, UNAM institutes, PEMEX and court systems.
- PEMEX compromise attributed by CloudSEK to the same MexicanMafia/PanchoVilla activity cluster (July 2024; month-level date).
- Mexico City Supreme Court (PJCDMX) breach claimed, with source code and credential dumps published (August 2024; month-level date).
- Start of the minimum 13-day campaign window documented in Chisel session logs (3,708 sessions); year inferred from the report's 2025-2026 campaign period.
- End of the confirmed 13-day Chisel session window; CloudSEK assesses true access duration is likely longer given the GRE tunnel persistence.
- CloudSEK publishes 'Operation Escaneo' analysis of exposed actor staging infrastructure (62.171.185.97), attributing the campaign to MexicanMafia/PanchoVilla with medium confidence.
Sources cited for Operation Escaneo
- Operation Escaneo: Infrastructure Exposure, TTP Analysis, and Attribution Assessment of an Advanced Intrusion Campaign Against Mexican Federal Agencies and Financial Institutions (CloudSEK)
- CloudSEK - Operation Escaneo (pt-br edition)
- CloudSEK - Navigating the Cyber Threat Landscape: Recent Attacks and Vulnerabilities in Mexico
- Operation Escaneo Signals Shift in LATAM Threat Landscape (daily.dev)
- Operation Escaneo Campaign Against LATAM Critical Infrastructure (detections.ai)
- Operation Escaneo - Campaign Analysis & Threat Activity (ThreatCluster)
- PanchoVilla - Threat Actor Profile, Campaigns & Targets (ThreatCluster)
Detection coverage for TL-2026-4318
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4318 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.