Straiker Links Mexico to CyberCartel

Update October 23, 2026: The new coverage expanded the scope attributed to CyberCartel, which is now linked to attacks against more than 400 financial institutions across Latin America, not just regional financial targets. It also added technical details about the repository, which held 4,493 records, and about the CARLIY0S system, which used agents from Claude, Grok, and Kimi.

Straiker identified a group called CyberCartel, which allegedly used artificial intelligence models to coordinate attacks against more than 400 financial institutions in Latin America. The report also mentioned possible links to Mexico, an infrastructure called CARLIY0S, and a financial database with references to SPEI, but it did not publicly confirm affected Mexican banks or specific breaches at individual institutions.

What did the report say about CyberCartel?

Straiker described the group as responsible for a campaign against more than 400 financial institutions in the region, according to coverage published by multiple media outlets. In that attribution, the actor also appears under the names AiPT-67 and Tr4nsHack Team, with a front called Hexagon Security Labs Mexico, but that label does not amount to a state attribution or a judicial identification.

The reference to CARLIY0S is part of the infrastructure the report linked to the activity attributed to CyberCartel. The available information does not provide independent outside validation of that relationship, so the mention should be read as part of the technical tracking disclosed by the firm, not as an official confirmation.

What was found about Mexico and SPEI?

Coverage of the report said a database called FinancialSoft was found on September 24, 2026, and contained sensitive financial records, along with information related to Mexico’s Interbank Electronic Payments System, SPEI. The same source clarified that it is not possible to determine which Mexican institutions may have been affected.

That leaves a key gap between the presence of references to Mexico in the material and confirmation of a concrete impact. As covered, the report did not publicly identify compromised Mexican banks or specify whether there was an actual intrusion against any particular institution in the country.

How strong is the technical attribution?

The technical coverage attributes to Straiker the tracking of the actor under the names AiPT-67 and Tr4nsHack Team, and links that activity to a front called Hexagon Security Labs Mexico. Even so, the material itself notes that the label does not amount to a state attribution or a judicial identification.

Global Enterprise Roundtable added that the inventory included more than 270 penetration test reports and more than 200 vulnerabilities, some described by Straiker as zero-days. Even so, the cited results do not include a CVE, outside validation, or a vendor notice confirming those vulnerabilities.

According to the coverage, the campaign also involved the alleged use of Claude, Grok, and Kimi agents to coordinate attacks against Latin American financial entities. That detail appears in several of the available sources, but it remains part of the Straiker report and not an independent confirmation.

What other technical details did the coverage add?

Later coverage added that a repository associated with the case contained 4,493 records, including 2,911 email addresses, 903 CLABE numbers, 391 API access keys, and 67 plaintext passwords. Those data expand the scope of the material attributed to the operation, although they still depend on the investigation cited by the media.

Automater.ai also described a system called CARLIY0S, with a Claude-based coordinating agent running inside Cursor, specialized agents for reconnaissance and exploit generation, Grok-based collectors, and Kimi models as a fallback when other models refused requests. Cybersecurity Times added three automated payloads associated with the system, Oracle database scanning, searches for JDBC strings and SSH keys, and internal subnet mapping, including the example 172.30.2.x.

CybersecurityNews reported that data obtained by Grok agents would have been centralized in a database called FinancialSoft and that Kimi would have served as a fallback mechanism when other models rejected offensive requests. That coverage presented both elements as additional technical details attributed to the Straiker report.

What did the coverage say about Mexico at this stage?

Infobae pointed to possible signs of a link between the operation and Mexico, but it did not publicly confirm that all affected entities were in that country or identify specific victims. That caution keeps open the gap between a technical reference to Mexico and confirmation of a concrete impact on Mexican institutions.

For now, the central point remains the same, references to SPEI and Mexico in the material are not enough to say that Mexican banks were publicly or verifiably compromised. The attribution still rests on Straiker’s reconstruction and the later coverage that expanded it.