--- title: "Operation Escaneo Signals Shift in LatAm Threat Landscape" url: https://daily.dev/posts/operation-escaneo-signals-shift-in-latam-threat-landscape-zafm1mwft source_url: https://www.darkreading.com/cybersecurity-operations/operation-escaneo-signals-shift-latam-threat-landscape type: article source: "Dark Reading" published: 2026-06-18T19:35:00.749Z updated: 2026-06-18T19:50:31.584Z tags: ["data-exfiltration"] reading_time: 5 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Operation Escaneo Signals Shift in LatAm Threat Landscape **[Dark Reading](https://daily.dev/sources/dr)** · 5 min read · 0 upvotes · 0 comments ## Summary CloudSEK has detailed Operation Escaneo, a sophisticated multistage cyberattack campaign attributed with medium confidence to the MexicanMafia/PanchoVilla threat group. Active between 2025 and 2026, the campaign primarily targeted critical infrastructure in Mexico, Ecuador, and Portugal. The group employs a proprietary reconnaissance engine (Kimera), exploits known CVEs in Fortinet, Ivanti, and Apache Tomcat, and uses layered C2 infrastructure including Neo-reGeorg webshells and Chisel reverse tunnels. Unusually for a financially motivated actor, MexicanMafia also appears to collect high-value intelligence such as SSL private keys and MDM infrastructure data — possibly without central coordination between monetization and espionage objectives. Researchers note this campaign signals a closing gap between cybercriminal and APT-level capabilities in Latin America, and recommend immediate patching of perimeter devices and improved network segmentation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense](https://daily.dev/posts/mexico-s-cybersecurity-plan-2025-2030-turning-ambition-into-defense-yfxuxkec0) · Recorded Future Blog · 0 upvotes · 0 comments --- Tags: [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/operation-escaneo-signals-shift-in-latam-threat-landscape-zafm1mwft)