Operation Escaneo Exploited Fortinet and Ivanti Devices Across Latin America

CloudSEK disclosed a coordinated intrusion campaign dubbed Operation Escaneo that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing Fortinet FortiOS SSL-VPN, Ivanti Connect Secure, and Apache Tomcat systems, while also maintaining capabilities for EternalBlue, Zerologon, GhostCat, Log4Shell, and PwnKit. CloudSEK attributed the activity with medium confidence to MexicanMafia, also tracked as PanchoVilla, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations.

The attackers used a custom reconnaissance framework called Kimera, Neo-reGeorg web shells, Chisel reverse tunnels, and persistence on compromised Cisco routers through GRE tunnels to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as RDP, PsExec, and Impacket for lateral movement and privilege escalation. Reported theft included a 407 MB BloodHound Active Directory dataset, more than 1.3 million personal records, and SSL private keys, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.