Loading threat actor…
The Sinaloa Cartel is a major Mexico-based transnational criminal organization centered on large-scale drug trafficking, money laundering, and associated violence. It has long been one of the most powerful criminal groups in Mexico and is widely linked to the trafficking of fentanyl, cocaine, methamphetamine, heroin, and other narcotics into the United States and other markets. Common aliases include Sinaloa, Sinaloa Cartel, and CDS. The Beltrán Leyva Organization originated as a faction within the broader Sinaloa Cartel milieu before becoming a distinct rival organization, but it is frequently referenced in connection with Sinaloa’s historical network and internal fragmentation. The organization is associated with highly adaptive operational tradecraft spanning logistics, corruption, financial laundering, and selective use of technology. Reporting has tied Sinaloa-linked actors to the acquisition or use of interception and surveillance capabilities, illustrating interest in communications intelligence for operational security and counter-surveillance. The cartel is also associated with sophisticated financial methods, including the use of cryptocurrency to launder proceeds, obscure fund flows, and facilitate cross-border value transfer. U.S. enforcement actions and sanctions have linked Sinaloa-associated networks and factions, including Los Chapitos, to cryptocurrency-enabled laundering, wire transfers, structured transactions, trade-based money laundering, and collaboration with Chinese underground banking and precursor-supply networks. These financial channels have been used both to move narcotics proceeds and to support procurement of precursor chemicals used in synthetic drug production. Sinaloa operates through a networked structure composed of senior leadership, family-based factions, regional cells, facilitators, transport specialists, money launderers, and armed enforcers. Prominent substructures and associated factions include Los Chapitos. Historically, the cartel has also been tied to figures such as Joaquín "El Chapo" Guzmán and his successors and relatives. Its activities rely on corruption, intimidation, coercion, and alliances with external brokers and suppliers. The group’s operational resilience has been reinforced by its ability to integrate traditional smuggling infrastructure with modern financial mechanisms and international procurement networks. The cartel primarily targets state institutions, rival criminal groups, transportation corridors, and civilian environments relevant to its trafficking and enforcement interests. It is known for orchestrating armed responses to state pressure, exerting territorial influence, and leveraging broad support networks to sustain production, transport, and revenue generation. Its cyber-relevant profile is less that of a conventional state-sponsored intrusion actor and more that of a technologically opportunistic criminal enterprise that adopts surveillance tools, encrypted communications, and digital assets when these capabilities advance trafficking, security, or laundering objectives. Sinaloa is not a nation-state actor. It is a transnational organized crime group based in Mexico whose scale, violence, and financial sophistication have made it a persistent focus of U.S. and Mexican law enforcement, sanctions, and counter-narcotics operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A major Mexican cartel referenced as conducting large-scale armed responses to state action and later fragmenting into warring factions, driving severe violence in Sinaloa.
The Sinaloa Cartel, including the Beltran Leyva Organization, is involved in large-scale drug trafficking and uses cryptocurrency to facilitate payments for fentanyl production and other cartel activities.
Uses cryptocurrency and Chinese money laundering networks to launder drug proceeds, move funds internationally, and support procurement of precursor chemicals for fentanyl and methamphetamine production.
Referenced as a Mexico-based drug cartel involved in fentanyl trafficking supply chains, purchasing precursor chemicals via Latin America-based brokers from China-based chemical suppliers; payments included Bitcoin.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.