Skip to main content
Mallory
Back to threat actors
🇲🇽 MX4 malware familiesExploits CVEs in the wild

MexicanMafia

Also known asMexicanMafia
Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial
OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Government & Administration
  • Utilities
  • Transportation
  • Telecommunication Services
  • Financial Services

Where they target

Geographies tied to known operations.

  • 🇲🇽 Mexico
  • 🇪🇨 Ecuador
  • 🇵🇹 Portugal

Where they're from

Attributed origin per open-source reporting.

  • MX
MITRE ATT&CK

Tradecraft

68 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

14 of 15 tactics107 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
5 techniques
T1589
Gather Victim Identity Information
T1589.001
Credentials
T1590
Gather Victim Network Information
T1590.001
Domain Properties
T1592
Gather Victim Host Information
T1593
Search Open Websites/Domains
T1593.002
Search Engines
T1595
Active Scanning
T1595.001
Scanning IP Blocks
T1595.002
Vulnerability Scanning
TA0042
Resource Development
4 techniques
T1583
Acquire Infrastructure
T1583.003
Virtual Private Server
T1587
Develop Capabilities
T1587.001
Malware
T1588
Obtain Capabilities
T1588.006
Vulnerabilities
T1608
Stage Capabilities
T1608.001
Upload Malware
TA0001
Initial Access
4 techniques
T1078
Valid Accounts
T1078.002
Domain Accounts
T1133
External Remote Services
T1190
Exploit Public-Facing Application
T1566
Phishing
T1566.002
Spearphishing Link
TA0002
Execution
4 techniques
T1059
Command and Scripting Interpreter
T1059.004
Unix Shell
T1059.007
JavaScript
T1059.008
Network Device CLI
T1072
Software Deployment Tools
T1203
Exploitation for Client Execution
T1569
System Services
T1569.002
Service Execution
TA0003
Persistence
5 techniques
T1078
Valid Accounts
T1078.002
Domain Accounts
T1133
External Remote Services
T1205
Traffic Signaling
T1505
Server Software Component
T1505.003
Web Shell
T1546
Event Triggered Execution
TA0004
Privilege Escalation
4 techniques
T1068
Exploitation for Privilege Escalation
T1078
Valid Accounts
T1078.002
Domain Accounts
T1546
Event Triggered Execution
T1548
Abuse Elevation Control Mechanism
TA0005
Stealth
5 techniques
T1027
Obfuscated Files or Information
T1036
Masquerading
T1036.005
Match Legitimate Resource Name or Location
T1078
Valid Accounts
T1078.002
Domain Accounts
T1140
Deobfuscate/Decode Files or Information
T1205
Traffic Signaling
TA0006
Credential Access
6 techniques
T1003
OS Credential Dumping
T1003.001
LSASS Memory
T1110
Brute Force
T1110.002
Password Cracking
T1212
Exploitation for Credential Access
T1552
Unsecured Credentials
T1552.001
Credentials In Files
T1552.005
Cloud Instance Metadata API
T1555
Credentials from Password Stores
T1555.003
Credentials from Web Browsers
T1558
Steal or Forge Kerberos Tickets
T1558.003
Kerberoasting
TA0007
Discovery
8 techniques
T1016
System Network Configuration Discovery
T1018
Remote System Discovery
T1046
Network Service Discovery
T1069
Permission Groups Discovery
T1069.002
Domain Groups
T1082
System Information Discovery
T1087
Account Discovery
T1087.002
Domain Account
T1135
Network Share Discovery
T1526
Cloud Service Discovery
TA0008
Lateral Movement
5 techniques
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1021.002
SMB/Windows Admin Shares
T1072
Software Deployment Tools
T1080
Taint Shared Content
T1210
Exploitation of Remote Services
T1550
Use Alternate Authentication Material
T1550.002
Pass the Hash
TA0009
Collection
5 techniques
T1005
Data from Local System
T1114
Email Collection
T1119
Automated Collection
T1185
Browser Session Hijacking
T1213
Data from Information Repositories
TA0011
Command and Control
6 techniques
T1001
Data Obfuscation
T1001.001
Junk Data
T1071
Application Layer Protocol
T1071.001
Web Protocols
T1090
Proxy
T1090.001
Internal Proxy
T1090.002
External Proxy
T1090.003
Multi-hop Proxy
T1132
Data Encoding
T1132.002
Non-Standard Encoding
T1205
Traffic Signaling
T1572
Protocol Tunneling
TA0010
Exfiltration
4 techniques
T1030
Data Transfer Size Limits
T1041
Exfiltration Over C2 Channel
T1048
Exfiltration Over Alternative Protocol
T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol
T1567
Exfiltration Over Web Service
TA0040
Impact
3 techniques
T1485
Data Destruction
T1491
Defacement
T1565
Data Manipulation
T1565.001
Stored Data Manipulation
ARSENAL

Associated malware families

4 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen
ChiselThe campaign is characterised by ... Chisel reverse tunnels ... Chisel reverse tunnels (3,708 sessions over campaign period) maintain network-layer connectivity.1Jun 17, 2026
KimeraThe campaign is characterised by a proprietary distributed reconnaissance engine (Kimera) ... Maintains a proprietary distributed reconnaissance framework (Kimera) with parallelised enumeration and automated vulnerability-to-exploitation pipeline.1Jun 17, 2026
Neo-reGeorgThe campaign is characterised by ... layered command-and-control infrastructure using Neo-reGeorg webshells ... Neo-reGeorg JSPX/JSP webshells with AES-encrypted channels and custom Base64 encoding provide primary persistent web access.1Jun 17, 2026
XortigateMultiple xortigate variants (v2–v4) with reverse shell payload to C2 ... FortiGate SSL-VPN devices are targeted via CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 chains, with multiple xortigate variants tuned for operational stability.1Jun 17, 2026
WEAPONIZED

Associated vulnerabilities

13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.

CVE-2017-0144EternalBlue SMBv1 Remote Code ExecutionIn the wildEvidence1

MS17-010 Windows SMB EternalBlue SMBv1 RCE Critical Multiple .rc scripts; confirmed exploitation attempt logs on Windows Storage Server 2008.

CVE-2020-0796SMBGhostIn the wildEvidence1

CVE-2020-0796 Windows SMBv3 SMBGhost Memory Corruption Critical (10.0) smbghost_scan.py + smbghost_payload.py; smbghost_shell.log.

CVE-2020-1206SMBleedIn the wildEvidence1

CVE-2020-1206 Windows SMBv3 SMBleed Info Disclosure + ASLR Bypass High (7.5) Chained with SMBGhost for stable RCE.

CVE-2020-1472Zerologon in Microsoft Netlogon Remote ProtocolIn the wildEvidence1

CVE-2020-1472 Windows Netlogon Zerologon Domain Escalation Critical (10.0) zerologon_tester.py confirming DC vulnerability before domain takeover.

CVE-2020-1938GhostcatIn the wildEvidence1

Apache Tomcat AJP connectors are exploited via GhostCat (CVE-2020-1938).

8 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

17 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

17 IOCsView more in app

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Start free trial
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping68

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal4

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs13

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables17

Domains, IPs, and hashes tied to this actor, refreshed continuously.