CloudSEK Details MexicanMafia-Linked Intrusion Campaign Targeting Latin American Organizations

Jun 17, 2026 · Original article ↗

Summary

CloudSEK analyzes artifacts from a threat actor’s staging server, describing a 2025–2026 campaign using vulnerability exploits, stolen credentials, webshells, and tunnels to access systems and extract data across Latin America.

Key points

CloudSEK says it found an open directory on a threat actor’s staging server during infrastructure discovery in early 2026; it assesses attribution to MexicanMafia, also known as PanchoVilla, with medium confidence.
The campaign primarily targeted government, tax, and utility organizations in Latin America, with additional activity against telecommunications, aviation, and a European financial institution.
The reported access methods include exploitation of Fortinet and Ivanti devices, Apache Tomcat, and other exposed services, as well as credential-based VPN access and phishing.
Artifacts showed use of Kimera reconnaissance tooling, Neo-reGeorg webshells, Chisel tunnels, compromised Cisco routers, and other mechanisms for persistence and lateral movement.
CloudSEK reports exfiltration of more than 1.3 million PII records and a 407 MB Active Directory dataset, along with credential and cryptographic material.
The report describes confirmed command-execution callbacks, a compromised Cisco router with a GRE tunnel, and 3,708 Chisel sessions logged over a 13-day period.
Recommendations include patching affected perimeter devices and servers, rotating potentially exposed credentials, enabling MFA, segmenting SAP and Oracle systems, and monitoring for webshells, tunnels, and suspicious execution.

Article Details

Attack Vectors: Exploitation of internet-facing Fortinet FortiOS SSL-VPN, Ivanti Connect Secure, Apache Tomcat AJP, GeoServer WFS, Oracle DBMS_SCHEDULER, and Java application servers.
Credential-based VPN, RDP, and other remote access using credentials extracted from configuration files, repositories, and systems.
Spear-phishing pages aimed at tax-authority employees and corporate document-management users to harvest credentials.
Exploitation of SMB vulnerabilities including EternalBlue, SMBGhost, Zerologon, and legacy NetAPI flaws for compromise or lateral movement.
Abuse of SAP RFC functions and Oracle or PostgreSQL database features to execute commands, access files, and retrieve data.
Use of webshells, Chisel reverse tunnels, SOCKS5 relays, and GRE tunnels on compromised Cisco routers for persistence, pivoting, and command and control.
Abuse of AnyDesk and crafted LNK files impersonating N-able RMM for additional remote access and persistence.
Defensive Notes: Patch affected Fortinet, Ivanti, Apache Tomcat, Windows SMB, VMware AirWatch, Java, Oracle, and GeoServer systems; disable or restrict exposed services and interfaces that are not required.
Monitor for high-concurrency reconnaissance, exploit scanning, webshell deployment, suspicious Java deserialization, and ZIP/WAR archive path traversal.
Alert on unusual SAP RFC command-execution calls, Oracle DBMS_SCHEDULER jobs invoking OS commands, unexpected UTL_FILE access, and database activity accessing sensitive files or keys.
Monitor Cisco IOS/IOS-XE for unexpected TCL execution and GRE tunnel configuration; watch for SOCKS5 relays, Chisel-like TCP-over-HTTP tunnels, and unusual TFTP transfers.
Require MFA for VPN, RDP, and administrative access; rotate credentials potentially exposed in FortiGate configuration dumps and audit repositories and files for stored secrets.
Restrict AnyDesk and N-able RMM to approved, inventoried deployments; monitor web-server directories for unexpected JSP, JSPX, ASPX, PHP, or other webshell files.

Indicators of compromise

Type	Indicator	Context
IPV4	`165[.]22[.]184[.]26`	Secondary attacker relay used for SOCKS5 proxying.
IPV4	`185[.]65[.]245[.]10`	Reported as a possible secondary C2 server.
IPV4	`45[.]61[.]137[.]126`	Intermediate IP used for SOCKS5-tunnelled exfiltration.
IPV4	`62[.]171[.]185[.]97`	Primary operator VPS used for C2, callbacks, payload staging, reverse-shell listening, and exfiltration.