Operation Escaneo Signals Shift in LatAm Threat Landscape

Operation Escaneo is a sophisticated, multistage intrusion campaign attributed to the MexicanMafia (PanchoVilla) targeting critical infrastructure across Latin America (primarily Mexico) during 2025–2026; the actor used a proprietary reconnaissance framework (Kimera), exploited Fortinet, Ivanti and Apache Tomcat vulnerabilities, deployed web shells and reverse tunnels, achieved router-level persistence, compromised SAP/Oracle systems, and exfiltrated credentials and cryptographic material (including tax authority SSL keys), prompting urgent patching, network segmentation, and enhanced monitoring.