MexicanMafia opsec_enum.sh Post-Exploitation Cleanup with ZipSlip Webshell

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects the execution of 'opsec_enum.sh', a post-exploitation cleanup script, and associated activity involving ZipSlip-based webshell persistence components (such as 'mkzip34.py' and specific chunked file names) used by the threat actor MexicanMafia during Operation Escaneo.