Report Evaluates Mexico’s National Cybersecurity Plan and Persistent Threats
Summary
Recorded Future assesses Mexico’s 2025–2030 cybersecurity plan against ransomware, financial malware, data theft, state-sponsored activity, hacktivism, and organized crime, and urges stronger coordination, incident readiness, and public cyber awareness.
Key points
- Mexico’s 2025–2030 plan sets phased goals including a national cybersecurity strategy, operations center, incident-response coordination, cyber range, and cybersecurity law.
- The report could not verify progress on key 2026 expansion goals, including the proposed law and planned training initiatives.
- Recorded Future identifies ransomware as Mexico’s dominant organizational threat, documenting 223 incidents involving 64 groups from January 2020 through April 2026.
- Government, healthcare, and financial organizations face significant exposure to ransomware, data theft, financial malware, and fraud.
- The report describes state-sponsored activity, hacktivism, and organized crime as additional risks, including cybercrime-as-a-service and cryptocurrency-enabled money laundering.
- The 2026 FIFA World Cup is expected to increase cyber risk to public services, transport, telecommunications, payment systems, and other digital infrastructure.
- Recommendations include threat monitoring, adopting security standards, scenario-based incident-response exercises, and educating staff and the public.
Article Details
- Publisher
- Recorded Future (Insikt Group)
- Report Period
- 2020–2026
- Scope
- Assessment of Mexico’s 2025–2030 National Cybersecurity Plan and cyber threat landscape.
- Sample Size
- Insikt Group documented 223 ransomware incidents involving 64 groups and over 100 victims from January 2020 to April 2026; its dark-web analysis found nearly 500 forum references across 26 industries and 308 usernames.
- Key Statistics
- The ATDT identified 155 ransomware victims in Mexico from November 2019 to September 2025; 16 incidents were disclosed by official sources and five by unofficial sources.
- Insikt Group documented 223 ransomware incidents involving 64 groups and over 100 victims across Mexico from January 2020 to April 2026.
- LockBit conducted 61 ransomware attacks against entities in Mexico, according to Insikt Group.
- Insikt Group reports approximately 780,000 payment cards exposed on the dark web in 2025 and approximately 162,000 records in the first quarter of 2026.
- Insikt Group found nearly 500 dark-web forum references concerning attacks targeting Mexico from January 2020 to April 2026, spanning 26 industries and 308 unique usernames.
- Recommendations
- Use cyber threat intelligence to track threat activity, exposed credentials, vulnerability exploitation, dark-web chatter, brand impersonation, and risks to internet-facing assets.
- Adopt cybersecurity standards such as the NIST Cybersecurity Framework or ISO/IEC 27001.
- Conduct scenario-planning and practical exercises for ransomware, data breaches, cyber espionage, hacktivism, and other digital threats.
- Educate employees and the public on recognizing phishing, protecting accounts with multifactor authentication, avoiding credential reuse, backing up data, and responding to incidents.
MITRE ATT&CK
T1486 · Data Encrypted for ImpactRansomware attacks are identified as a major threat affecting organizations in Mexico.T1491.002 · External DefacementChronus Team’s reported modus operandi includes website defacements.T1566 · PhishingPhishing is described as a tactic used in financial malware campaigns and by hacktivist groups.
People
Andrés Manuel López ObradorFormer president whose administration largely deprioritized cyber policy, according to the article.Claudia SheinbaumPresident whose administration committed to implementing the National Cybersecurity Plan.Enrique Peña NietoFormer president whose administration published Mexico’s 2017 National Cybersecurity Strategy.Jesús LucÃa Trasviña WaldenrathSenator who presented a cybersecurity-coordination bill in January 2026; the article says its relationship to the Plan’s proposed General Cybersecurity Law is unclear.
Threat Actors
adrxxThreat actor identified by Insikt Group as claiming on DarkForums to have leaked data involved in the CNSF disclosure.AgendaListed parenthetically with Qilin in the article’s list of top ransomware groups impacting Mexican entities.ALPHVListed among the top ransomware groups impacting Mexican entities; the article lists BlackCat parenthetically with this name.BITWISE SPIDERListed parenthetically alongside LockBit Gang in the article’s list of top ransomware groups impacting Mexican entities.BlackCatListed parenthetically with ALPHV in the article’s list of top ransomware groups impacting Mexican entities.Chronus MafiaName formed by the reported March 2026 merger of Chronus Team and Mexican Mafia Team.Chronus TeamHacktivist group reported to target institutions in Latin America, particularly Mexico, and to claim responsibility for data leaks affecting Mexican public organizations.Cl0pListed among the top ransomware groups impacting Mexican entities; the article lists FANCYCAT parenthetically with this name.ContiNamed as a ransomware group whose dismantled victims are not included in the Plan’s ransomware counts.DEV-0396Listed parenthetically alongside LockBit Gang in the article’s list of top ransomware groups impacting Mexican entities.FamousSparrowPresented parenthetically with TAG-141 in the article; associated with the reported SparrowDoor deployment against a Mexican university.FANCYCATListed parenthetically with CL0P in the article’s list of top ransomware groups impacting Mexican entities.Flighty ScorpiusListed parenthetically alongside LockBit Gang in the article’s list of top ransomware groups impacting Mexican entities.GuacamayaHacktivist group reported to have compromised Mexico’s Secretariat of National Defense in 2022.HiveNamed as a ransomware group whose dismantled victims are not included in the Plan’s ransomware counts.KazuListed among the top ransomware groups impacting Mexican entities.LockBit GangListed among the ransomware groups impacting Mexican entities; LockBit is reported to have conducted 61 attacks against entities in Mexico.MazeNamed as a ransomware group whose dismantled victims are not included in the Plan’s ransomware counts.Mexican Mafia TeamThe article says Chronus Team merged with Mexican Mafia Team in March 2026 to form Chronus Mafia.MexicnonThreat actor reported to have auctioned 23,000 Mexico-issued payment cards on Exploit Forum in 2025.QilinListed among the top ransomware groups impacting Mexican entities; the article lists Agenda parenthetically with this name.RedLimaChinese state-sponsored group reported by Insikt Group to have conducted opportunistic cyber-espionage operations during the 2024 Paris Olympics.TAG-141Insikt Group reported that it deployed SparrowDoor against Universidad Nacional Autónoma in Mexico; the article presents FamousSparrow parenthetically with this name.TGR-STA-1030Asia-linked tracked actor observed targeting at least 70 government and critical-infrastructure organizations for cyber espionage.
Malware
AsyncRATIn 2025, AsyncRAT, DanaBot, and KV-Botnet were the top three malware families, respectively, based on the number of unique victims, and DanaBot, Beavertail, and LummaC2 led in observed infections in Mexico.BeaverTailIn 2025, AsyncRAT, DanaBot, and KV-Botnet were the top three malware families, respectively, based on the number of unique victims, and DanaBot, Beavertail, and LummaC2 led in observed infections in Mexico.CasabaneiroAmong the most prolific banking trojans active over the past few years are Mispadu, Grandoreiro, and Casabaneiro (Mekotio).DanabotIn 2025, AsyncRAT, DanaBot, and KV-Botnet were the top three malware families, respectively, based on the number of unique victims, and DanaBot, Beavertail, and LummaC2 led in observed infections in Mexico.FenixActive since 2022, the Fenix botnet began targeting users of government services, particularlyGrandoreiroAmong the most prolific banking trojans active over the past few years are Mispadu, Grandoreiro, and Casabaneiro (Mekotio).KV-BotnetIn 2025, AsyncRAT, DanaBot, and KV-Botnet were the top three malware families, respectively, based on the number of unique victims, and DanaBot, Beavertail, and LummaC2 led in observed infections in Mexico.LummaC2In 2025, AsyncRAT, DanaBot, and KV-Botnet were the top three malware families, respectively, based on the number of unique victims, and DanaBot, Beavertail, and LummaC2 led in observed infections in Mexico.MekotioAmong the most prolific banking trojans active over the past few years are Mispadu, Grandoreiro, and Casabaneiro (Mekotio).MispaduAmong the most prolific banking trojans active over the past few years are Mispadu, Grandoreiro, and Casabaneiro (Mekotio).SparrowDoorIn February 2025, Insikt Group revealed that TAG-141 (FamousSparrow) had deployed SparrowDoor malware against Mexico’s Universidad Nacional Autónoma, likely as part of a campaign to access research in areas related to
Vendors
Products
Countries
ArgentinaThe hacktivist group Chronus Team emerged in late 2025, primarily targeting institutions in Latin America, particularly Mexico, Argentina, Brazil, and Bolivia.BoliviaThe hacktivist group Chronus Team emerged in late 2025, primarily targeting institutions in Latin America, particularly Mexico, Argentina, Brazil, and Bolivia.Brazilin the upper ranks of Latin American nations for demonstrating a strong commitment to cybersecurity (Brazil and the US are the only countries in the Americas listed in Tier 1).Canadathe International Telecommunication Union’s (ITU) 2024 Global Cybersecurity Index, placing it alongside Canada, Ecuador, and Uruguay in the upper ranks of Latin American nations for demonstrating a strong commitmentChinaCapital flight restrictions in China have also created an opportunity that CMLNs and Mexican DTOs have learned to exploit.MexicoMexico recently unveiled a new National Cybersecurity Plan to be implemented over the remainder of this decade.North KoreaMexico has also been subjected to North Korea-sponsored remote IT-worker schemes, and in January 2025, a Mexican national was indicted for facilitating a scheme that targeted multiple US and European companies in orderUnited StatesMexico also remains an attractive target for state-sponsored cyber activity due to its deep integration with United States (US) supply chains, nearshoring-linked manufacturing base, and underdeveloped cybergovernance.
Industries
EducationSimilarly, Insikt Group is unable to determine whether a proposed broad-based cyber education campaign targeting federal employees (“APF Cibersegura,” meant to be launched in the second quarter of 2026) or a plannedEnergyMexican organizations operating in high-risk sectors such as government, finance, energy, telecommunications, or critical infrastructure should consider using the Recorded Future platform to track threat actor activity,Financial Servicesand deepfakes, and to educate them on data protection on social media and the secure use of digital financial services.Food and BeverageThe top industries affected were government, manufacturing, information technology, and food and beverage, as demonstrated in Figure 2.GovernmentThe government, healthcare, and financial sectors have been the primary targets of cyber threat actors, and ransomware continues to be the top threat to Mexican organizations.HealthcareThe government, healthcare, and financial sectors have been the primary targets of cyber threat actors, and ransomware continues to be the top threat to Mexican organizations.Hospitalityinfrastructure, public services, transport systems, telecommunications networks, ticketing platforms, hospitality sector, and local government systems under unusual strain and scrutiny.Information TechnologyThe top industries affected were government, manufacturing, information technology, and food and beverage, as demonstrated in Figure 2.InsuranceIn February 2026, the National Commission of Insurance and Surety (CNSF) publicly disclosed via an official notice that an unknown threat actor gained unauthorized access, resulting in the exposure of intermediary IDLaw enforcementHowever, the Plan does not mention victims of ransomware groups that have been dismantled by international law enforcement (such as Maze, Conti, and Hive).ManufacturingMexico also remains an attractive target for state-sponsored cyber activity due to its deep integration with United States (US) supply chains, nearshoring-linked manufacturing base, and underdeveloped cybergovernance.TelecommunicationsOn December 4, 2025, Mexico’s 2025–2030 National Cybersecurity Plan (hereinafter, the Plan) was published by the Mexican Digital Transformation and Telecommunications Agency (ATDT).TransportationDefense (SEDENA), a 2022 ransomware attack on the Secretariat of Infrastructure, Communications, and Transportation (SICT), a 2023 BlackByte ransomware attack against the National Water Commission (CONAGUA), and a