“Chisel logs alone recorded 3,708 sessions over a 13-day window.”
Operation Escaneo exposed by CloudSEK
CloudSEK discovered and mapped a coordinated campaign it calls Operation Escaneo after finding an open directory on the group's server in early 2026. The firm says the error allowed researchers to reconstruct the attackers' toolkit and activity, revealing a sustained operation that targeted critical infrastructure across Mexico with lesser activity in Ecuador and Portugal. Affected sectors included government, tax authorities, utilities, transport, telecoms and banks.
Perimeter appliances: Fortinet and Ivanti CVEs used
CloudSEK reported that the attackers primarily gained entry through internet-facing security appliances. The group kept tuned exploits for Fortinet FortiOS SSL‑VPN flaws — specifically CVE-2022-42475 and CVE-2024-21762 — and Ivanti Connect Secure flaws CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282. Researchers said the attackers adapted public proof‑of‑concept code so it would not crash targets.
Beyond VPN and SSL‑VPN appliances, the campaign also used exploits for Apache Tomcat's GhostCat flaw, Windows vulnerabilities EternalBlue and Zerologon, and Log4Shell, broadening the range of entry points into victim networks.
Kimera reconnaissance, Neo‑reGeorg and tunneling
The attackers relied on a custom reconnaissance engine named Kimera, which CloudSEK said scanned and triaged targets at high speed and then handed them to the exploitation stage. Once inside, the group layered access to maintain connectivity: Neo‑reGeorg webshells provided encrypted footholds on web servers; Chisel reverse tunnels carried traffic over HTTP; and a compromised Cisco router was fitted with a GRE tunnel pointing back to the attackers, a network‑level channel CloudSEK noted could be invisible to host‑based defenses.
CloudSEK's artifact set shows these channels were active and persistent: the Chisel logs alone recorded 3,708 sessions during a 13‑day period, illustrating the scale and repetitiveness of the operation's remote access.
Data stolen: transport records, Active Directory maps, SSL keys, SAP and Oracle access
Inside victim networks the attackers reached SAP and Oracle systems to run commands and extracted large volumes of sensitive information. CloudSEK said confirmed beacons from at least five victims and large‑scale data theft. Among items enumerated by the firm were:
- More than 1.3 million personal records from one transport provider
- A 407MB map of a victim's Active Directory
- SSL private keys, streamed out live from a database server
- SAP service‑account hashes and browser‑stored passwords
Those artifacts show the attackers were not simply probing perimeter devices but moving into enterprise applications and databases to harvest identity, cryptographic and application credentials.
Attribution: Mexican Mafia (Pancho Villa) with medium confidence
CloudSEK attributed Operation Escaneo, with medium confidence, to a group it calls Mexican Mafia, or Pancho Villa. The firm notes the group spent 2024 claiming breaches against Mexican government, judicial and energy targets, sometimes framing the hacks as protest, though CloudSEK also warned that some of the group's past claims have been disputed by the organizations named.
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: CloudSEK urged patching perimeter appliances first, explicitly singling out the Fortinet and Ivanti flaws. Teams should also hunt for quieter tells the report identifies — GRE tunnels reaching external addresses, Chisel's TCP‑over‑HTTP traffic and unexpected commands executed through SAP and Oracle.
- Policymakers and regulators: The operation underscores the risk to national‑scale critical infrastructure from exploited internet‑facing appliances and the need for guidance and enforcement mechanisms focused on timely patching of perimeter gear and monitoring for network‑level tunnels.
- Procurement and affected enterprises: The findings highlight the operational cost of exposed or unpatched VPN and remote‑access appliances and the need to validate vendor firmware updates, logging visibility for tunnels such as GRE, and controls around extraction of SSL keys and service account data from enterprise applications.
Operation Escaneo, as reconstructed by CloudSEK, is notable for its breadth — multiple CVEs across vendor products, a high‑speed reconnaissance engine called Kimera, and layered persistence combining webshells, application exploitation and network‑level tunnels. It was the attackers' own operational security failure — an exposed staging directory — that allowed researchers to assemble this picture. What remains are clear, immediate actions CloudSEK recommends (patch perimeter appliances and hunt for GRE and Chisel traffic) and unanswered questions about the full scope of victims and the longer‑term reuse of harvested credentials and keys.
Original story: LATAM Infrastructure Hit by Fortinet and Ivanti Exploits (Infosecurity Magazine)
