MexicanMafia Impacket Portable Bundle AD Enumeration via mini_imp

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects the execution of Impacket tools from a specific portable bundle path ('mini_imp/') often utilized by the threat actor MexicanMafia during 'Operation Escaneo'. The activity involves Active Directory enumeration and reconnaissance of service accounts, including those associated with SQL services, Citrix administrators, and CyberArk vault operators.