Mexico: AI-Linked Attack Hits Government, Water

Between December 2025 and February 2026, an unidentified adversary compromised multiple Mexican government organizations, stole large amounts of sensitive government data and civil records, and then turned the same operation against a municipal water and drainage company serving the Monterrey metropolitan area, according to Dragos and Gambit Security, as cited by Cryptonomist.

What happened in the campaign against the Mexican government and water services in Monterrey?

Dragos and Gambit Security reported that between December 2025 and February 2026 an unidentified adversary compromised multiple Mexican government organizations and stole large volumes of sensitive government data and civil records. According to the report cited by Cryptonomist, the same operation later spread to a municipal water and drainage company serving the Monterrey metropolitan area.

On that second front, Dragos said the initial IT compromise developed into an attempted intrusion into OT systems in January 2026. The report describes the case as a move from the corporate environment into operational infrastructure, although it does not publicly detail which controls or assets were exposed.

The analysis also concluded that this adversary does not overlap with any previously tracked threat group. Dragos described it as a new category of attacker assisted by artificial intelligence, a reading that sets it apart from known clusters and more traditional attribution.

According to the report cited by Cryptonomist, the actor used artificial intelligence models such as Anthropic’s Claude and OpenAI’s GPT to help with the intrusion and data theft in the campaign against Mexican government organizations.

What other operation was described in the region?

In parallel, reports on the PhantomEnigma campaign described a different scheme. Q2B Studio said ANY.RUN uncovered a compromised government infrastructure in Brazil that was used to attack banking and the public sector.

The same coverage says that, in a July 2026 update, early evidence about a global cyberattack on banks pointed to a state-sponsored group known as APT34, previously linked to attacks on financial institutions. No organization has officially claimed responsibility for that campaign.

For Latin America, the broader picture still shows pressure on critical and financial sectors. An ESET report cited by CanalNews Ecuador placed banking and finance as the region’s second most targeted sector, with 57.8% of organizations reporting detected attacks. The same survey said EDR adoption stood at 69.1% and DLP at 57.6%, with no specific attribution to APT groups or state actors.

The combination of campaigns using abused public infrastructure, access to OT systems, and AI models to assist intrusions leaves the region facing operations that do not always map to a tracked actor.