Loading story…
CloudSEK disclosed a coordinated intrusion campaign dubbed Operation Escaneo that targeted government, financial, and critical infrastructure organizations across Latin America, with Mexico as the primary focus and additional victim activity in Ecuador and Portugal. Researchers traced the operation after attackers accidentally exposed a staging server, revealing a mature toolchain that exploited internet-facing Fortinet FortiOS SSL-VPN, Ivanti Connect Secure, and Apache Tomcat systems, while also maintaining capabilities for EternalBlue, Zerologon, GhostCat, Log4Shell, and PwnKit. CloudSEK attributed the activity with medium confidence to MexicanMafia, also tracked as PanchoVilla, and said confirmed victim beacons and callbacks showed successful compromise of multiple organizations.
The attackers used a custom reconnaissance framework called Kimera, Neo-reGeorg web shells, Chisel reverse tunnels, and persistence on compromised Cisco routers through GRE tunnels to retain access and evade detection. Investigators said the campaign moved across Windows, Linux, SAP ERP, Oracle, PostgreSQL, and network infrastructure, using tools such as RDP, PsExec, and Impacket for lateral movement and privilege escalation. Reported theft included a 407 MB BloodHound Active Directory dataset, more than 1.3 million personal records, and SSL private keys, including material tied to tax authority infrastructure, indicating both financially motivated theft and possible intelligence collection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CloudSEK said it observed confirmed beacons or RCE callbacks from at least five victims and documented extensive exfiltration activity. Reported theft included a 407 MB BloodHound Active Directory dataset, more than 1.3 million extracted records, and SSL private keys.
Researchers uncovered the campaign after attackers accidentally exposed a staging server online, enabling analysis of the group's infrastructure, custom Kimera reconnaissance framework, exploit arsenal, and persistence mechanisms. Artifact analysis from the exposed server at 62.171.185.97 also revealed use of Neo-reGeorg, Chisel, and GRE tunnels on compromised Cisco routers.
CloudSEK reported that a multistage intrusion campaign dubbed Operation Escaneo targeted government, financial, and critical infrastructure organizations across Latin America during 2025 and 2026. Mexico was the primary focus, with additional activity in Ecuador and Portugal.
CloudSEK assessed with medium confidence that the campaign was linked to the threat actor MexicanMafia, also known as PanchoVilla. The reporting described the actor as mature, cross-platform capable, and blending financially motivated theft with possible intelligence collection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceinfosecurity-magazine.com
Open sourcedarkreading.com
Open sourcecloudsek.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors exploited internet-exposed Palo Alto Networks PAN-OS management interfaces by chaining **`CVE-2024-0012`** and **`CVE-2024-9474`**, a combination that enabled authentication bypass followed by privilege escalation to run arbitrary commands as **root** on affected firewall devices. Security reporting described a surge in exploitation after public disclosure, with campaigns targeting exposed firewalls and quickly moving from initial access to hands-on post-compromise activity. Investigators observed attackers validating exploitation with OAST domains, retrieving payloads with tools such as `curl` and `wget`, and establishing **Sliver** command-and-control. Follow-on activity included downloads of ELF, shell script, and PHP payloads, persistence through cron jobs and web shells, suspicious TLS traffic without SNI, use of uncommon ports, reconnaissance, lateral movement, and cryptomining tied to infrastructure including **herominers** and **xmrig**. One repeatedly downloaded payload, **`/palofd`** from **`38.180.147[.]18`** with SHA1 **`90f6890fa94b25fbf4d5c49f1ea354a023e06510`**, was linked by open-source reporting to **Spectre RAT**, indicating that compromised perimeter devices were being used for broader intrusion activity rather than simple opportunistic exploitation.
Jun 29, 2026
Russian and China-linked threat activity has relied on common but effective entry points to penetrate government, telecom, defense, energy, and other critical-sector networks. Ukrainian officials said CERT-UA recorded **5,927 cyber incidents** in 2025, a **37.4% increase** over the prior year, with Russian groups including **UAC-0002 (Sandworm)**, **UAC-0001 (APT28)**, **UAC-0010 (Gamaredon)**, and **UAC-0190 (Void Blizzard)** using exposed **RDP** services, vulnerable **VPN** appliances, supply-chain compromise, phishing, and stolen credentials to gain access. Separately, telecom intrusions tied to the China-linked cluster **UAT-9244** used exposed web applications, **ProxyLogon**, exposed **SSH** services, weak credentials, and unpatched server software to establish footholds in Linux-heavy environments. Once inside, the actors deployed a broad toolset for espionage, persistence, and disruption, including RATs, stealers, ransomware, wipers, and Linux malware such as **PeerTime**, which supports multiple architectures and uses peer-to-peer, BitTorrent-like communications to avoid reliance on centralized command-and-control. The reporting highlights exploitation of products including **Cisco ASA/AnyConnect**, **Roundcube**, **Fortinet**, **WinRAR**, **7-Zip**, and legacy Microsoft Office components, alongside social-engineering tactics such as **ClickFix**, device-code phishing, OAuth phishing, and QR-code hijacking. The campaigns also abused legitimate services and native system tools, while under-monitored embedded Linux devices, routers, edge systems, and container hosts were described as especially attractive for long-term persistence, lateral movement, scanning, and covert communications.
Jun 29, 2026
Multiple maximum-severity vulnerabilities in enterprise infrastructure management products are being **actively exploited**, enabling unauthenticated remote code execution as `root` and creating high-impact initial access paths into data center and security operations environments. Reported exploitation includes mass, automated scanning and rapid weaponization following public disclosure and PoC availability, increasing the likelihood of opportunistic compromise, follow-on payload delivery, and lateral movement in affected networks. Fortinet *FortiSIEM* is reported as under active attack via **CVE-2024-23108**, an unauthenticated command-injection issue in the `phMonitor` component (noted as listening on TCP `8014`) that can yield full system compromise. Separately, Cisco *Secure Email Gateway* / *Secure Email and Web Manager* is reported as exploited via **CVE-2024-20353** (CVSS 10.0), with activity attributed to China-linked **UAT-9686** leveraging the Spam Quarantine interface to gain root execution and deploy custom malware for persistence and evasion. In parallel, Check Point-linked reporting describes **RondoDox** botnet-driven exploitation of HPE *OneView* **CVE-2025-37164** at scale (tens of thousands of attempts observed), consistent with an “exploit-shotgun” approach used to build botnets for DDoS, cryptomining, and secondary payload delivery; the surge coincided with the flaw’s addition to CISA’s known-exploited list.
Jun 29, 2026