Mexico: AI and IT exposed OT risk

Update October 28, 2026: The investigation added details on initial access, proxy tunnels and the use of AI-generated tools. It also specified two automated password-spraying attempts against the industrial gateway interface, both of them unsuccessful.

An intrusion in the IT environment of a Monterrey water and drainage company led to failed attempts to access a gateway tied to OT. CompTIA and Computer Weekly linked the case to a broader campaign against Mexican entities, powered by malicious scripts generated with artificial intelligence and access techniques that were conventional, but lowered the time and expertise needed to run the intrusion.

What did the technical analysis find?

Computer Weekly reported that the broader campaign compromised nine Mexican government organizations between late December 2025 and mid-February 2026, based on forensic material recovered by Gambit Security and reviewed by Dragos. The analysis relied on more than 350 recovered artifacts, most of them malicious scripts generated with artificial intelligence.

The same analysis described the incident as AI-enabled access, not an attack with an effect on the industrial process. No evidence was found of a move into the OT environment or of any novel industrial attack capability.

CompTIA added that the observed techniques, including network discovery, credential attacks, exploitation and lateral movement, were conventional. The difference was that the models reduced the time and expertise needed to combine them into an operational campaign.

Where did the IT to OT exposure point appear?

According to CompTIA, the vNode gateway was discoverable from the compromised IT environment and used password-only authentication. That detail broadens the technical context for the exposure risk between IT and OT in the case under review.

Dragos said the initial access into the Monterrey water and drainage utility likely came through a vulnerable web server or stolen credentials, although the vector could not be confirmed. During the intrusion, the attacker used proxy tunnels and AI-generated tools for reconnaissance, enumeration and lateral movement. Two automated password-spraying attempts against the industrial gateway interface failed.

The sequence did not show, according to the analysis cited by Computer Weekly, any confirmed advance into the industrial environment. It did show that an initial IT compromise can open the door to attempts against assets associated with operations.

What are they warning about in Mexico's energy pipelines?

A specialist in the energy pipeline sector said the integration of new cybersecurity technologies and artificial intelligence in Mexico's energy pipelines is still limited. The specialist also said monitoring and protection capabilities are needed for that strategic infrastructure.

The warning comes as the discussion over operational systems and critical infrastructure protection overlaps with campaigns that use AI to speed up the intrusion phase. In the Mexican case analyzed by Computer Weekly and CompTIA, the initial access took place in IT, but the technical focus centered on the potential bridge to OT and the weakness of exposed authentication mechanisms.

Computer Weekly's analysis, based on forensic material recovered by Gambit Security and reviewed by Dragos, also said the campaign compromised nine Mexican government organizations between late December 2025 and mid-February 2026, although attribution remained unresolved. It also said more than 350 artifacts were analyzed, mainly malicious scripts generated by AI, and that Claude Code was used for planning and technical execution while GPT-4.1 processed the collected data.

That same work said AI accelerated known techniques, but did not show any new industrial capability or prove that the attacker developed or executed a capability to physically affect the process.

Mexico was also associated with 60 alleged ransomware victims in critical infrastructure, according to El Economista, although without independent confirmation or a sector breakdown.