Intelligence Group
Request a quote
Home › Campaigns › AI-Assisted Breach of Mexico's Government Infrastructure

AI-Assisted Breach of Mexico's Government Infrastructure

C0064
2025-12-01 to 2026-02-01
66
Techniques
1
Malware Used
0
Attributed Groups
13
Tactics Covered
About This Campaign

The AI-Assisted Breach of Mexico's Government Infrastructure is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation, privilege escalation, discovery, credential harvesting, and exfiltration operations. The attack impacted several Mexican government institutions including the Federal Tax Authority (Servicio de Administracion Tributaria), Mexico State Government (Estado de Mexico), Mexico City Civil Registry (Registro Civil de CDMX), Jalisco State Government, National Electoral Institute (Instituto Nacional Electoral), Michoacan State Government, SADM Monterrey Municipal Water Utility (Agua y Drenaje), Tamaulipas State Government, and the Mexico City Health Department (Salud CDMX). The attack resulted in the theft of large amounts of sensitive government data and civilian records. Please note that due to the breadth of this campaign, public reporting only provides select details and as a result this campaign should not be considered comprehensive.

Techniques by Tactic (66)
Reconnaissance
T1592.004 Client ConfigurationsT1595.002 Vulnerability ScanningT1682 Query Public AI Services
Resource Development
T1583.003 Virtual Private ServerT1583.006 Web ServicesT1585 Establish AccountsT1587 Develop CapabilitiesT1587.004 ExploitsT1588.002 ToolT1588.007 Artificial IntelligenceT1683.001 Written Content
Initial Access
T1078 Valid AccountsT1078.003 Local AccountsT1190 Exploit Public-Facing Application
Execution
T1053.003 CronT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.004 Unix ShellT1059.006 PythonT1059.009 Cloud APIT1699 Direct Prompt Injection
Persistence
T1053.003 CronT1078 Valid AccountsT1078.003 Local AccountsT1098.004 SSH Authorized KeysT1505 Server Software ComponentT1505.003 Web ShellT1554 Compromise Host Software Binary
Privilege Escalation
T1053.003 CronT1078 Valid AccountsT1078.003 Local AccountsT1098.004 SSH Authorized Keys
Stealth
T1014 RootkitT1027.010 Command ObfuscationT1027.013 Encrypted/Encoded FileT1036.001 Invalid Code SignatureT1070.006 TimestompT1078 Valid AccountsT1078.003 Local Accounts
Credential Access
T1003.002 Security Account ManagerT1003.003 NTDST1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1003.006 DCSyncT1003.008 /etc/passwd and /etc/shadowT1110 Brute ForceT1110.002 Password CrackingT1110.003 Password SprayingT1187 Forced AuthenticationT1552 Unsecured CredentialsT1552.003 Shell HistoryT1552.004 Private KeysT1555 Credentials from Password Stores
Discovery
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1526 Cloud Service Discovery
Lateral Movement
T1021 Remote ServicesT1021.004 SSHT1210 Exploitation of Remote Services
Collection
T1074 Data StagedT1119 Automated CollectionT1213 Data from Information RepositoriesT1213.006 Databases
Command & Control
T1090.001 Internal ProxyT1090.002 External ProxyT1102 Web ServiceT1105 Ingress Tool TransferT1572 Protocol Tunneling
Exfiltration
T1020 Automated Exfiltration
Intelligence data sourced from MITRE Enterprise CTI. Built 2026-10-14 01:30 UTC by Intelligence Group.
↑