Operation Escaneo: Infrastructure Exposure, TTP Analysis, and Attribution Assessment of an ...

This report documents a coordinated, multi-stage campaign run by a threat actor targeting critical infrastructure across Latin America. Artifacts from the threat actor's staging server reveal a sophisticated operational toolchain spanning all phases of the MITRE ATT&CK framework, from automated reconnaissance through data exfiltration. The campaign is characterised by a proprietary distributed reconnaissance engine (Kimera), a curated exploit armory targeting enterprise perimeter devices (Fortinet, Ivanti, Cisco), portable lateral movement toolkits, and layered command-and-control infrastructure using Neo-reGeorg webshells, Chisel reverse tunnels, and compromised Cisco routers with persistent GRE tunnels.

The threat actor demonstrated capability to operate across Windows and Linux environments, compromise SAP ERP and Oracle database systems for command execution, extract cryptographic material and Active Directory datasets, and maintain long-dwell access through multiple redundant persistence mechanisms. Based on the available information, we have attributed this campaign with medium confidence to MexicanMafia aka PanchoVilla.

Known/Claimed Attacks by Pancho Villa

1. Oaxaca State Police (Secretaría de Seguridad y Protección Ciudadana) — March 2024 Pancho Villa posted on Breach Forums claiming to have exfiltrated 2,935,021 lines of data spanning 2007–2024, totalling over 800MB. The data included names of detained individuals, personal data, and police officer credentials. When the state government denied the breach, Pancho Villa defaced the official Oaxaca government website in the early hours of April 3, 2024, inserting the group's image as proof — where it remained visible until at least 8am that day.

2. "Chilango Leaks" — Mexico City Government (CDMX) — April 2024 Mexican Mafia released 20GB of what they called "Chilango Leaks," which included approximately 2.1 million private emails from over 2,000 CDMX public servant accounts across agencies ranging from the Secretaría de Obras y Servicios to the DIF.

3. UNAM — Instituto de Investigaciones en Matemáticas Aplicadas y en Sistemas (IIMAS) — early 2024 Member "Lord Peña" obtained 2.3 million files from UNAM's IIMAS, including banking data, for which he asked $500.

4. UNAM — Instituto de Investigaciones Filológicas (IIFL) — April 2024 Member "Dyce" hacked UNAM's IIFL and put up for sale a 29GB database claiming to contain network credentials, full names, images, and access keys.

5. SAT (Tax Authority) — Vulnerabilities Disclosed — March/April 2024 Lord Peña disclosed at least three vulnerabilities in the SAT website during the annual personal income tax filing period in 2024.

6. ORFIS Veracruz (Órgano de Fiscalización Superior) — March 2024 Lord Peña listed access to ORFIS internal servers on Breach Forums for $1,500.

7. Estado de México Government — March 2024 Member "Buda" put up for sale a database of subdomains from the State of Mexico government.

8. Quálitas Insurance — June 2024 Pancho Villa claimed to hold 300,000 lines of Quálitas Mexico customer data including names, phone numbers, addresses, and insurance types, offered for sale at $400.

9. PEMEX — July 2024 Mexican Mafia breached servers contracted by PEMEX and obtained over 50 databases with 11,000 records including employee contracts, names, email addresses, and payroll data. The data was initially listed at $1,000, then raised to $2,000 to, as Pancho Villa stated, "push away intelligence researchers."

10. Poder Judicial de la Ciudad de México (PJCDMX) — August 2024 Mexican Mafia compromised the Mexico City Supreme Court, offering 300,000+ user credentials from their appointments and case management system (SICOR/OPC), covering data from 2017 to 2024 including pension claims, legal filings, actuarial assignments, and payment receipts. After a 72-hour ultimatum expired without a sale, they published source code and credentials of 162,439 users, including accounts from UNAM (1,192), IMSS, ISSSTE, SEP, and the FGR. Pancho Villa said the breach took "10 to 15 minutes" due to unpatched legacy systems.

11. Tribunal Superior de Justicia de Oaxaca — October 2024 Mexican Mafia claimed access to over 30 terabytes of data from the Oaxaca Superior Court, including videos of court proceedings that exposed the identities of those involved in legal cases. Pancho Villa framed this as a protest against government neglect of indigenous communities.

In early 2026, during routine malicious infrastructure discovery, CloudSEK discovered an open directory hosted on 62.171.185[.]97.

Based on the artefacts obtained from the server, we were able to comprehensively map the capabilities of the threat actor.

The threat actor exhibits TTPs consistent with a well-resourced, operationally disciplined group with established infrastructure and custom tooling development capability. The following characteristics are assessed with high confidence from artifact analysis.

The following table maps all observed techniques to the MITRE ATT&CK Enterprise framework v15. Each row reflects direct artifact evidence from the threat actor's staging server.

The threat actor maintains a curated and operationally-tested exploit collection spanning perimeter devices, Windows SMB services, Linux privilege escalation, and Java application servers. Exploits are customised from public PoCs for operational stability.

The following tools were identified across artifacts. The threat actor deploys both open-source tools and custom-developed frameworks, often packaging open-source tools in portable execution environments to bypass EDR detection on restricted networks.

The campaign opens with the Kimera distributed footprinting engine executing parallelised subdomain enumeration across targets using four concurrent tools with file descriptor limits removed. dnsx resolves at 200 threads, naabu port-scans at 5,000 packets/second, and httpx fingerprints live hosts with randomised user agents. LinkFinder extracts JavaScript endpoints for hidden API and admin panel discovery. Kimera V2 seamlessly transitions from discovery to automated nuclei scanning and dalfox XSS validation without manual intervention.

Primary entry is achieved via exploitation of internet-facing VPN and application servers. FortiGate SSL-VPN devices are targeted via CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762 chains, with multiple xortigate variants tuned for operational stability. Ivanti Connect Secure is targeted via the CVE-2023-46805/CVE-2024-21887 authentication bypass and command injection chain. Apache Tomcat AJP connectors are exploited via GhostCat (CVE-2020-1938). Where direct exploitation is not viable, cleartext credentials extracted from FortiGate configuration dumps enable legitimate VPN authentication. Spear-phishing infrastructure is maintained in parallel for credential harvesting.

Code execution is achieved through multiple application-layer substrates: Oracle DBMS_SCHEDULER jobs execute OS commands with UTL_FILE feedback loops; SAP RFC SXPG_CALL_SYSTEM provides authenticated command execution after credential validation via STFC_CONNECTION; GeoServer WFS request parsing triggers Java Runtime.getRuntime() execution confirmed via out-of-band callbacks; ysoserial CommonsCollections5 payloads target unpatched Java application servers. Multiple webshell variants (PHP, JSP, CFM, WSDL) provide redundant execution paths.

Neo-reGeorg webshells with AES-encrypted channels and custom base64 encoding provide primary persistent web access. Chisel reverse tunnels (3,708 sessions over campaign period) maintain network-layer connectivity. GRE tunnels are programmatically configured on compromised Cisco routers pointing to the attacker VPS, providing network-device-level persistence invisible to host-based detection. AnyDesk and N-able RMM are abused for additional remote access. ZipSlip archives ensure webshell re-deployment upon data restoration.

PwnKit CVE-2021-4034 is deployed in chunked format for root access on Linux hosts, immediately validated by reading /etc/shadow. Zerologon CVE-2020-1472 is tested against domain controllers to confirm full domain compromise capability. GPP XML artifacts map privileged domain accounts as escalation targets. SAP function modules extract /etc/shadow without requiring OS root, bypassing traditional privilege boundaries. Heap grooming and memory spraying achieve privileged execution on FortiOS.

Movement proceeds through multiple parallel paths: EternalBlue MS17-010 via SOCKS5 proxy to internal 10.39.x.x subnets with process migration hardening; MS08-067 for legacy Windows nodes; SambaCry for Linux/Unix hosts; PsExec with harvested domain credentials; Impacket portable bundle for wmiexec and ntlmrelayx. A compromised internal host (10.39.1.204) functions as a relay node for multi-hop movement. Neo-reGeorg SMB probing covers 10.8.7.0/24 for Active Directory and file enumeration.

Collection targets credentials, PII, cryptographic material, and Active Directory datasets. Oracle tables are batch-extracted in 100,000-row increments via SQL*Plus spooling. PostgreSQL sys_eval pipelines SSL private keys directly to Netcat listeners. A 407MB BloodHound Active Directory dataset is compressed and exfiltrated. ELF binaries are chunked into ~3.9KB fragments for threshold evasion. SOCKS5-tunneled routing through intermediate nodes provides attribution mitigation during egress.

The following detection recommendations are derived from specific observed TTPs. Priority should be given to detections covering C2 infrastructure (Neo-reGeorg, Chisel), SAP/Oracle execution abuse, and network device persistence, which represent the highest-impact and most operationally distinctive behaviours.

Network-layer control

Long-dwell persistence