# Operation Escaneo: MexicanMafia (PanchoVilla) Intrusion Campaign Against Mexican Government Agencies and Latin American Financial Institutions

> CloudSEK analysis of staging-server artifacts (62.171.185.97) attributes, with medium confidence, a 2025-2026 intrusion campaign to MexicanMafia (aka PanchoVilla). The actor used custom frameworks (Kimera V1/V2, Xortigate v2-v4), open-source tooling (Nuclei, Chisel, Neo-reGeorg, Impacket) and exploits against Fortinet, Ivanti, Tomcat, SMB and Log4j, with 1.3M+ PII records, a 407 MB Active Directory dataset and SSL private keys reported exfiltrated.

- **Published:** 2026-10-23T23:31:29Z
- **Last reviewed:** 2026-10-23T23:31:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4318
- **ID:** TL-2026-4318
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** MexicanMafia
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-42475, CVE-2023-27997, CVE-2024-21762, CVE-2023-46805, CVE-2024-21887, CVE-2025-0282, CVE-2020-1938, CVE-2020-0796, CVE-2020-1472, CVE-2021-4034, CVE-2020-1206, CVE-2022-22972, CVE-2021-44228

## Description

Operation Escaneo is a 2025-2026 intrusion campaign against Mexican federal agencies, Mexican and Latin American financial institutions, with secondary targeting in Ecuador and Portugal. CloudSEK (report published 2026-06-17) derived the analysis from artifacts exposed on actor staging infrastructure, primarily the operator VPS 62.171.185.97, and attributes the activity with medium confidence to MexicanMafia, also tracked as PanchoVilla. The campaign window confirmed from Chisel session logs is a minimum of 13 days (January 28 to February 10), with 3,708 logged Chisel sessions; CloudSEK assesses this is likely only a fraction of the total access.

Initial access relied on exploitation of internet-facing perimeter and application services: Fortinet FortiOS SSL-VPN (CVE-2022-42475 with a custom stability-tuned variant, CVE-2023-27997 via the 'Xortigate' v2-v4 exploit, CVE-2024-21762), Ivanti Connect Secure (CVE-2023-46805 chained with CVE-2024-21887, and CVE-2025-0282), Apache Tomcat AJP GhostCat (CVE-2020-1938, ajpShooter.py), Log4Shell (CVE-2021-44228, JNDI/LDAP callback listener) and VMware AirWatch (CVE-2022-22972 assessment). The actor also abused Oracle DBMS_SCHEDULER/UTL_FILE, SAP RFC function modules (SXPG_CALL_SYSTEM, SXPG_COMMAND_INSERT), GeoServer WFS injection and PostgreSQL sys_eval for command execution. CloudSEK reports confirmed RCE beacons from at least 5 victim IPs.

A custom reconnaissance engine, Kimera V1/V2, chains subfinder, assetfinder, findomain, dnsx, naabu (5,000 pps), httpx, gowitness, LinkFinder, whatweb, Nuclei and Dalfox into an automated discovery-to-exploitation pipeline. Post-exploitation used a portable Impacket bundle (mini_imp/: psexec, wmiexec, smbexec, secretsdump, GetUserSPNs), Metasploit resource scripts for MS17-010/MS08-067/SambaCry, SMBGhost and Zerologon testers, PwnKit (CVE-2021-4034) for local privilege escalation, Kerberoasting, BloodHound/SharpHound, password spraying scripts and harvested credentials from FortiGate, Cisco, PostgreSQL, MSSQL and Zimbra artifacts.

Persistence and command-and-control were layered: Neo-reGeorg webshells (JSPX/JSP/ASPX/PHP) with AES encryption, custom JSP/PHP webshells, a ZipSlip dropper (mkzip34.py, xpw3.jsp), a Chisel reverse proxy, multi-hop SOCKS5 relays via 165.22.184.26 and proxychains, a GRE tunnel configured over IOS-XE SSH on a compromised Cisco router pointing back to 62.171.185.97, and abuse of AnyDesk and N-able-themed LNK lures. Reported exfiltration includes 1.3M+ Oracle PII records (dump_batch.sh, 100K-row batches), a 407 MB compressed BloodHound Active Directory dataset, Kerberoast hashes, Chrome credential stores, network device configurations and PostgreSQL SSL private keys streamed with Netcat to 62.171.185.97:8888.

Attribution rests on TTP and targeting continuity with historical MexicanMafia/PanchoVilla activity against Mexican government entities (2024 claims include Oaxaca State Police, Mexico City government, UNAM institutes, PEMEX and court systems), plus infrastructure and tooling maturity. CloudSEK notes caveats: some historical breach claims are disputed by victims, and the separate 2025-2026 AI-assisted Mexican government breach reported by Gambit Security was not attributed to this actor. No campaign-level CVSS score is published.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.003 Virtual Private Server
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.004 Unix Shell
- T1059.008 Network Device CLI
- T1505.003 Web Shell
- T1027 Obfuscated Files or Information
- T1558.003 Kerberoasting
- T1552.001 Credentials In Files
- T1110.003 Password Spraying
- T1046 Network Service Discovery
- T1021.002 SMB/Windows Admin Shares
- T1572 Protocol Tunneling
- T1090.003 Multi-hop Proxy
- T1219 Remote Access Tools
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

## Sources

- [Operation Escaneo: Infrastructure Exposure, TTP Analysis, and Attribution Assessment of an Advanced Intrusion Campaign Against Mexican Federal Agencies and Financial Institutions (CloudSEK)](https://www.cloudsek.com/blog/operation-escaneo-mexican-government-financial-institutions-cyberattack)
- [CloudSEK - Operation Escaneo (pt-br edition)](https://www.cloudsek.com/pt-br/blog/operation-escaneo-mexican-government-financial-institutions-cyberattack)
- [CloudSEK - Navigating the Cyber Threat Landscape: Recent Attacks and Vulnerabilities in Mexico](https://www.cloudsek.com/ar/blog/navigating-the-cyber-threat-landscape-a-comprehensive-report-on-recent-attacks-and-vulnerabilities-in-mexico)
- [Operation Escaneo Signals Shift in LATAM Threat Landscape (daily.dev)](https://daily.dev/posts/operation-escaneo-signals-shift-in-latam-threat-landscape-zafm1mwft.md)
- [Operation Escaneo Campaign Against LATAM Critical Infrastructure (detections.ai)](https://detections.ai/intel-exchange/019edaac-6a31-7680-95db-6db59787a3b9)
- [Operation Escaneo - Campaign Analysis & Threat Activity (ThreatCluster)](https://threatcluster.io/entities/campaign/Operation%20Escaneo)
- [PanchoVilla - Threat Actor Profile, Campaigns & Targets (ThreatCluster)](https://threatcluster.io/entities/apt-group/PanchoVilla)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4318