Loading threat actor…
CJNG, also known as the Jalisco New Generation Cartel, is a Mexico-based organized crime group led historically by founder and supreme commander Nemesio Oseguera Cervantes, also known as El Mencho. It has been described as a large, hierarchical cartel with a franchise-style expansion model and an estimated membership in the tens of thousands operating across more than 20 Mexican states. In February 2025, the United States designated CJNG as both a Foreign Terrorist Organization and a Specially Designated Global Terrorist entity. CJNG has demonstrated a high degree of organization, paramilitary capability, and capacity for coordinated violence against Mexican state forces. Reported armed components include specialized units such as Grupo Élite, Fuerzas Especiales Mencho, and drone operators. The group has been linked to the use of military-grade weapons, armored vehicles, and coordinated retaliatory actions across multiple states. Its operations have included sustained armed clashes with Mexican military and security forces, including attacks on aircraft and large-scale roadblock and arson campaigns intended to disrupt transportation, commerce, and public order. The cartel’s activities are primarily associated with narcotics trafficking and related organized crime, and its violence has targeted Mexican government and security institutions as well as civilian infrastructure during retaliatory campaigns. Documented behavior includes coordinated attacks, armed engagements, intimidation, and destructive disruption following leadership targeting by the Mexican state. Available information in this record supports characterization of CJNG as a highly capable criminal-paramilitary actor centered in Mexico, with dominant financial motivation tied to cartel activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A highly organized cartel described as a paramilitary enterprise engaged in sustained armed confrontations with Mexican security forces, capable of coordinated multi-state retaliatory violence, use of military-grade weapons, and specialized armed units for territorial control, protection, and drone operations.
Referenced as the cartel that Sensi and Campo were allegedly attempting to support through money laundering and weapons procurement arrangements.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.