Operation Escaneo Targets Latin American Critical Infrastructure

Operation Escaneo is a coordinated cyberattack attributed to the MexicanMafia group, targeting critical infrastructure across Latin America, primarily Mexico. The campaign, which spanned from 2025 to 2026, utilized sophisticated tools including a proprietary reconnaissance engine named Kimera and exploits for vulnerabilities in Fortinet and Ivanti systems. Researchers reported that over 150GB of sensitive data was stolen, including personal records and SSL private keys. The attack vector involved exploiting internet-facing security appliances and lateral movement within victim networks. Despite claims of massive data theft, some Mexican authorities denied any breaches occurred. The operation's complexity and scale indicate a significant threat to national security and critical services.

Key Points: • Operation Escaneo involved sophisticated tools and tactics targeting Latin American infrastructure. • The MexicanMafia group is attributed with medium confidence for this multi-stage campaign. • Over 150GB of sensitive data was reportedly stolen, affecting various government and financial entities.