MexicanMafia AD Dataset Extraction via ntds.dit and secretsdump

Ethan Andrews@eandrews

•updated Jun 23, 2026•1•0•5

Detects Active Directory dataset extraction techniques used by MexicanMafia (Operation Escaneo), including ntds.dit access, secretsdump execution, VSS shadow copy abuse, and BloodHound-style AD enumeration for long-term persistence and reconnaissance against critical infrastructure.