Loading story…
Mexico has introduced a new national cybersecurity plan as the country faces sustained pressure from financial malware, fraud, data theft, hacktivism, and organized cybercrime. Recorded Future’s Insikt Group said Mexico ranks among the top five countries globally for infostealer victims and is also one of Latin America’s leading source countries for stolen payment cards, with threats including AsyncRAT, DanaBot, KV-Botnet, Mispadu, Grandoreiro, and Casabaneiro affecting users and institutions.
The threat picture also includes extensive dark web activity and politically charged intrusions. Researchers identified nearly 500 references to cyberattacks targeting Mexico between 2020 and April 2026, alongside notable leaks involving journalist data from the presidential press system and intermediary credentials tied to the CNSF. Hacktivist actors such as Chronus Team and Guacamaya were highlighted as influential, while the government’s plan prioritizes critical infrastructure protection ahead of the 2026 FIFA World Cup and public awareness on phishing, social engineering, deepfakes, and safer digital financial practices.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Mexico published its 2025–2030 National Cybersecurity Plan through the Mexican Digital Transformation and Telecommunications Agency (ATDT) to improve national cyber resilience and modernize federal cyber policy. The plan was framed as a response to repeated cyber incidents affecting federal, state, and local institutions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mexico has announced its first-ever national cybersecurity plan, marking a significant step toward strengthening the country's digital resilience. The plan is expected to address critical areas such as cybercrime, infrastructure protection, and the development of a coordinated national response to cyber threats, reflecting a growing recognition of cybersecurity as a national priority. In parallel, the United States government is preparing to revisit foundational cybersecurity policies as part of a new national strategy. The forthcoming U.S. strategy reportedly includes executive actions targeting cybercrime and ransomware, as well as an offensive component aimed at preemptively disrupting foreign adversaries' hacking operations. Both countries are signaling a shift toward more proactive and comprehensive approaches to national cybersecurity.
Jul 12, 2026
Latvia’s National Security Service (SAB) reported that **2025 saw a record high in registered cyber threats** targeting the country, with **Russia** assessed as the primary source of cyber risk amid Latvia’s support for Ukraine. SAB said most activity was linked to cybercrime and digital fraud, but the most serious cases included **intrusion attempts, malware distribution, equipment compromise, and DDoS attacks**, and it warned that **operational technology (OT)** in energy, water, and transport often lacks sufficient protections. The agency also noted that Russian-linked hacktivist activity has shown willingness and capability to target industrial control systems for short-term disruption and intimidation, and that DDoS activity against government and critical services often aligns with politically sensitive events. In the UK, senior national security figures warned Parliament that resilience alone may be insufficient against **cyber and hybrid threats** (including sabotage and disinformation), arguing the country needs an **offensive deterrence** component to impose costs on hostile states rather than “absorbing” attacks. Separately, Check Point Research data cited by Dark Reading indicated **Latin America and the Caribbean** experienced the highest average weekly attack volume globally (3,065 attacks per week; **+26% YoY**), with prevalent activity including **information disclosure**, attempts at **remote code execution** and **authentication bypass**, and a shift toward **data-leak extortion**, credential theft, and **edge-device exploitation**; the report also projected continued ransomware growth, particularly affecting healthcare and manufacturing.
Jun 29, 2026
The **Dark Tequila** malware campaign targeted users in Mexico, particularly customers of Mexican banking institutions, in a long-running financial theft operation active since at least 2013. Attackers used **spear-phishing** and infected **USB devices** to compromise systems, then deployed a multi-stage payload designed to evade analysis with anti-debugging and anti-virtual-machine checks. Once installed, the malware harvested banking credentials, website logins, saved passwords, and other sensitive data, then exfiltrated the information to command-and-control servers in encrypted form. The toolset included modules for **keylogging**, information theft, USB propagation, watchdog services, cleanup, and C2 communications, and it could remotely uninstall itself from systems outside Mexico or otherwise deemed irrelevant to the operators.
Aug 15, 2026