Mexican Mafia

MexicanMafia, also tracked as PanchoVilla and in some reporting associated with Mexican Mafia Team, is a Latin America-focused threat actor linked with medium confidence to a sophisticated multistage intrusion campaign known as Operation Escaneo. The actor has been observed targeting critical infrastructure and public-sector organizations primarily in Mexico, with additional activity in Ecuador and limited activity in Portugal. Reported victim sectors include government, tax authorities, utilities, transportation, telecommunications, financial services, judicial entities, and energy organizations. The actor demonstrates mature offensive capability across Windows, Linux, enterprise application, and network infrastructure environments. Observed tradecraft includes automated reconnaissance, exploitation of internet-facing perimeter systems, deployment of web shells and reverse tunnels, credential theft, extraction of cryptographic material, Active Directory mapping, privilege escalation, lateral movement, and long-term persistence. Tooling associated with the actor includes a proprietary reconnaissance framework called Kimera, Neo-reGeorg web shells, Chisel reverse tunnels, and persistence through compromised Cisco routers using GRE tunnels. The actor has also been reported exploiting vulnerabilities in Fortinet, Ivanti, Apache Tomcat, Windows SMB services, and Linux polkit, and using techniques and tooling such as Zerologon, EternalBlue, PwnKit, RDP, PsExec, and Impacket. Post-compromise activity has included access to SAP ERP and Oracle database systems for command execution and data theft, theft of service-account material and browser-stored credentials, extraction of large identity datasets, and compromise of SSL private keys and mobile device management infrastructure. Reporting indicates the actor maintains redundant persistence mechanisms and is capable of adapting public exploit code and combining host-level and network-level access to evade detection and preserve long dwell time. MexicanMafia has also been described as making breach claims against Mexican government, judicial, and energy targets during 2024, sometimes framing activity as protest or hacktivism. At the same time, technical reporting on Operation Escaneo indicates a blend of opportunistic monetization and possible intelligence collection, making the actor’s characterization somewhat mixed. In March 2026, Mexican Mafia Team reportedly merged with Chronus Team to form Chronus Mafia, suggesting overlap with the broader Latin American hacktivist and cybercriminal ecosystem.