Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Cybercrime / Breach-and-Leak / Opportunistic Intrusion Cluster — Origin: Mexico (assessed)

Author: iQBlack CTI Team

Executive Summary

Mexican Mafia Hackers Team, also referred to publicly as Mexican Mafia, is best assessed as a Mexico-focused cyber intrusion and data-leak cluster that gained visibility during 2024 through a rapid sequence of breaches, leak sales, and public humiliation operations affecting Mexican government entities, academic institutions, and selected private-sector organizations. Public reporting repeatedly associates the cluster with the handles Pancho Villa, Lord Peña, Dyce, and a smaller set of recurring aliases. Confidence is medium: the victim pattern and recurring actor labels are consistent, but many specific claims still come from actor-controlled or actor-amplified channels.

The cluster’s operational profile is not that of a mature ransomware program or a high-end espionage unit. Instead, it appears to revolve around opportunistic compromise of exposed services, extraction of large volumes of e-mails or database content, selective free release of samples to prove access, and subsequent sale or threatened release through criminal forums. In several reported cases, the group appears to have exploited weak public-facing infrastructure and outdated web or mail platforms rather than advanced custom tooling.