MexicanMafia mini_imp Portable Impacket Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•5

Detects the execution of portable Impacket tools ('mini_imp'), including psexec.py, secretsdump.py, and ntlmrelayx.py. This activity is indicative of potential credential harvesting, remote service execution, or NTLM relay attacks, as observed in the MexicanMafia 'Operation Escaneo' campaign.