Operation Escaneo Campaign Against LATAM Critical Infrastructure

Operation Escaneo is a multi-stage intrusion campaign attributed with medium confidence to the MexicanMafia (aka PanchoVilla) threat actor group. The campaign targets critical infrastructure across Latin America, specifically government agencies, tax authorities, and financial institutions in Mexico, Ecuador, and Portugal. The group demonstrates high operational maturity, utilizing a proprietary distributed reconnaissance framework called Kimera and a curated exploit armory targeting enterprise perimeter devices from Fortinet, Ivanti, and Cisco.

Technical analysis of the actor's staging server revealed an extensive toolchain including Neo-reGeorg webshells, Chisel reverse tunnels, and persistent GRE tunnels on compromised Cisco routers. The actor has successfully exfiltrated over 1.3 million records, including PII and Active Directory datasets, and demonstrated the ability to execute code within SAP ERP and Oracle database environments. This activity represents a significant threat to regional stability and data privacy for the targeted sectors.