TLDR Tech / InfoSec
Operation Escaneo: Infrastructure Exposure, TTP Analysis, and Attribution Assessment of an Advanced Intrusion Campaign Against Mexican Federal Agencies and Financial Institutions
An exposed open directory on 62.171.185[.]97 let CloudSEK reconstruct the full toolchain of Operation Escaneo, attributed with medium confidence to MexicanMafia (aka PanchoVilla): a custom distributed recon engine (Kimera), a stability-tuned exploit armory against Fortinet/Ivanti/Cisco perimeter gear, and layered persistence via Neo-reGeorg webshells, Chisel tunnels (3,708 sessions over 13 days), and GRE tunnels on compromised Cisco routers invisible to host-based detection. The strategic lesson is that a financially motivated criminal crew has assembled APT-grade operational discipline, including on-premise credential cracking to avoid exfiltrating hashes, per-target proxychains documentation, and network-layer footholds that survive credential rotation. The campaign mirrors the same playbook as the separately reported AI-assisted breaches of Mexican agencies, signaling that LATAM's public sector now faces espionage-caliber tradecraft from actors whose primary aim is profit.
Read the full story