CyberCartel Linked to Mexico's SPEI

Straiker attributed the acquisition of 43 credentials from a fintech to CyberCartel, credentials that could have supported activity tied to SPEI in Mexico. The company involved was not publicly identified, and there was no confirmed intrusion or confirmed activity. Other coverage of the same analysis also mentions a broad inventory of exposed accesses and credentials, but the published evidence does not prove a specific Mexican bank victim or any verified impact.

What did the analysis say about initial access?

The analysis cited by several media outlets describes a set of credentials and keys that, if valid, could have opened access to different services and systems. IT SOCIAL reported, also citing Straiker, 391 API keys, 20 JWT signing keys, 20 Keycloak credentials, 67 plaintext passwords, 51 portal credentials, 19 Wasabi accesses, 15 Mailgun accesses, and six backdoors.

That list broadens the technical scope of the finding, but it does not change the central point. What has been published does not by itself prove a confirmed intrusion or identify a specific Mexican financial entity. The attribution still rests on Straiker’s analysis, not on an independent public confirmation of a specific victim.

What is known about the alleged SPEI link?

The alleged link to SPEI appears in coverage describing activity consistent with testing or preparation for operations associated with Mexico’s payment system, but without confirming illicit transfers. XenoSpectrum said Straiker described test activity, although it did not report whether any operations were carried out or what their value might have been.

Among the published pieces, Entrepreneur en Español noted that the investigation does not show SPEI was breached or quantify any impact or financial losses. That distinction is key to reading the case carefully, because it keeps a technical finding from being turned into a confirmed financial incident.

What regional scope did the investigation suggest?

The available reporting places the case within a broader campaign against financial institutions in Latin America. El Economista, citing Straiker, referred to CyberCartel and to a possible use of credentials to facilitate operations tied to SPEI, while IT SOCIAL described an inventory of exposed assets that suggests a wide attack surface.

Lado.mx also reported a version of a Mexico-linked network that would have used Claude and Grok in cyberattacks against Latin American banking. Even so, based on the material available, there is no state attribution or public confirmation of a specific Mexican bank as the final victim of the episode.