Mexico Cybersecurity Report: September 2026

Threats and Active Campaigns in Mexico

Ransomware and extortion: sustained pressure, partial classification

Mexico accounted for 19 cases with ransomware or extortion as the primary focus within the 61 incidents in the period, but only part of that total could be classified precisely. In one case, the material refers only to the victim’s appearance on a leak site, while in 18 cases the source does not allow us to determine whether there was encryption, exfiltration, or simply a public extortion claim.

That distinction matters. The month’s signal is not just whether there was more or less ransomware, but that sources index group activity unevenly. For operational reading, the 19 cases should be treated as active extortion pressure, without assuming the same technical method in all of them.

Qilin and Grupo Juste

Qilin was one of the most repeated names in the Mexican material for the month. Different tracking platforms recorded Grupo Juste as a victim, but the available material did not allow an independent confirmation of the real scope or the compromised data.

The source describes a claim on a leak site and not necessarily a ransom event validated by the organization. That places the episode in the category of a mention or incomplete classification, not confirmed operational impact.

KRYBIT, Tender and other claims in Mexico

KRYBIT appeared linked to several Mexican entries, including Tender, Grupo Juste and other cases listed on monitoring platforms. In some records, the incident appears as a claim or victim posting, but the material does not independently confirm either the intrusion or the exfiltration.

At the tactical level, what is clear is the persistence of extortion pressure on Mexican service, retail and manufacturing companies. The challenge for analysis is that many sources of this type describe the leak site, not the underlying technical incident.

Fraud and phishing: no single case, but plenty of operational signal

There were no fraud or phishing cases documented as closed incidents within the period, but campaigns, alerts and sector responses were abundant. The most visible front was digital banking, where Condusef and ABM stressed mobile malware, impersonation of institutions, code theft and the use of fake apps.

This is not a risk gap. It was a month in which fraud showed up mainly as a campaign pattern and as accumulated statistics, not as a single standalone event. The right reading is in the set of warnings, claims and operational recommendations.

APT, intrusion with AI tools and activity against critical infrastructure

The campaign attributed to CL-CRI-1131 stands out as the clearest case of sophisticated intrusion outside the financial axis. Unit 42 and sources that cite its analysis describe an operation against a transportation organization, federal ministries and municipal water utilities in Mexico and Ecuador, using living-off-the-land, batch scripts and tooling hosted on attacker infrastructure.

The material also mentions the use of AI to generate code and explore networks in the case of the Monterrey water provider, although by mid-September no service disruption had been confirmed as attributable to that activity. The relevant technical detail is that the attempt to pivot toward OT was blocked.

Critical vulnerabilities affecting Mexico

Technically, September brought a mix of flaws in edge appliances, Windows systems and routers widely used in small networks. The common thread was the need for urgent patching, but with a catch, several of these vulnerabilities were already being exploited at the time of coverage, so the real response window was short.

Citrix, Microsoft and MikroTik appearing in the same month points to different attack surfaces. This was not only about ransomware or fraud. Part of Mexico's risk in September came from exposed infrastructure and edge devices that, if left unpatched, can open the door to intrusion, lateral movement and persistence.

Regulation and compliance in Mexico

September was a dense month for regulation. Banxico and the CNBV moved rules on transfers, authentication, and user experience. Congress pushed forward bills on digital identity, AI, data protection, and cybersecurity, while the data protection authority kept acting on exposure cases and sanctions.

The news is not just the volume of initiatives, but the convergence of topics. Digital identity, biometrics, payment security, critical infrastructure, and platform liability started to appear in the same political and regulatory package.

Banxico, the CNBV, and the reshaping of payments and authentication

Banxico published Circular 9/2026 with a compliance deadline of December 14, 2026, for adjustments to mobile apps and transfer rules. At the same time, the material shows consultations and changes on SMS authentication, interchange fees, and user experience standardization.

For compliance teams, the signal is twofold. There is more regulatory detail on how digital channels must operate, but also more risk of rolling out partial or rushed changes. The impact is not abstract, it affects onboarding, authentication, user support, and anti-fraud monitoring.

Digital identity, biometrics, and data protection

Deputy Karina Margarita del Río Zenteno promoted an initiative to elevate to constitutional status the right to a secure, interoperable, and free digital identity. At the same time, other proposals targeted a General Law on Digital Identity and Citizenship, and the harmonization of rules on data protection, cybersecurity, and electronic signatures.

In the financial sector, regulation already incorporates fingerprint and facial biometrics as part of customer identification. That makes biometric data governance more important, because the regulatory surface is no longer limited to credentials and passwords.

Cybersecurity as an evolving legislative framework

The Senate received a bill to enact a Cybersecurity Law that proposes a National Cybersecurity Agency, a CSIRT, and a national system. The bill is still under review, so it should not be treated as current law, but it does signal the policy agenda.

In parallel, Congress advanced other regulatory pieces on AI, digital content, and platform liability. The result is a month in which Mexican regulation moved quickly, although it still has not closed a unified framework.

Most affected sectors in Mexico

The financial sector was again the most exposed by volume of signals, though not always by the same type of incident. Alerts on fraud, guidance from Condusef and ABM, complaint reports, authentication changes, and references to biometrics all converged in the same month. This was not a single attack, but a persistent risk surface.

Services, government, transportation, and healthcare also stood out, mainly because of ransomware incidents, breaches, or outages, and intrusions that cut across multiple verticals. In the public sector, the material again points to a classic problem, the late confirmation of scope, which makes it harder to distinguish between exposure, compromise, and a criminal claim.

Industry and manufacturing remain under pressure, especially in ransomware contexts and in activity linked to Russian-speaking actors. The BlackCat case and the reference to more than a dozen affected Mexican industrial and manufacturing companies reinforce that reading, although not every mention carries the same evidentiary weight.

In utilities and essential services, the main signal came from water and energy infrastructure. The Monterrey case and the operation targeting municipal water, along with events in the southeast power sector and reports on Hidalgo’s C5i, show that interest in critical services does not fade even when the final confirmation of operational damage is uneven.

Trends and signals to watch in Mexico

The main trend this month was a drop in the number of unclassified incidents and ransomware cases compared with the previous month, but with a tradeoff, the number of critical CVEs mentioned rose and regulatory volume held steady. That points to less noise on some fronts and more technical pressure on others, not a structural improvement in risk.

The month-over-month comparison also shows that documented fraud and phishing fell from 5 to 0 in the September material. That should not be read as real relief in risk, because the month itself was full of warnings about bank fraud, fake apps and financial brand impersonation. What declined was the count of closed incidents in the sample, not the underlying exposure.

In ransomware, the drop from 22 to 19 primary-axis cases does not erase the continuity of the phenomenon. September shifted more toward damage classification, mentions on leak sites and distributed extortion pressure than toward major episodes with confirmed encryption.

The other signal to watch is the regulatory acceleration. The previous month already brought movement in payments and authentication, but September added digital identity, AI, legislative cybersecurity and data protection. For compliance teams, that means more touchpoints between legal, technology and risk functions.

Security recommendations for Mexico

1. Review perimeter exposure and mobile channels immediately, especially in environments using Citrix NetScaler, Windows, and MikroTik devices. This month’s actively exploited vulnerabilities leave no room for long patch cycles.

2. Prioritize detection of credential theft and account takeover in digital banking. This month’s material shows campaigns by email, SMS, and fake apps, plus mobile overlays and verification code capture.

3. Tighten monitoring for data leakage and postings on leak sites, because part of the ransomware activity during the period appears only as a mention or an unconfirmed claim. It is worth separating encryption, exfiltration, and simple extortion pressure with discipline.

4. Review governance around personal and biometric data. Between Aeroméxico, digital identity initiatives, and facial recognition and fingerprint capture rules, the regulatory focus is no longer limited to passwords, but also includes sensitive identity information.

5. Validate response plans with the business and with vendors. The Aeroméxico case again showed that third parties and external platforms can sit at the center of an incident, even if technical attribution remains open.

6. Prepare an updated compliance map for Banxico, CNBV, and Congress. Obligations on transfers, user experience, identity, and data protection accumulated in September and should not be treated as isolated pieces.

Frequently Asked Questions

What changed in Mexico between the banking fraud and September ransomware?

In September, banking fraud stopped appearing as a closed incident in the sample, but it continued to dominate the operational conversation through alerts from Condusef, ABM and Banxico. Ransomware remained the leading threat by volume, with 19 of 61 incidents, and it was also supported by leak sites and incomplete classification.

What is the link between Aeroméxico, digital identity and data protection?

Aeroméxico became the focus of an investigation after a base was offered on Telegram, while Congress and the federal administration pushed initiatives on digital identity, data protection and cybersecurity. The three lines converge on the same point, more sensitive personal data and greater regulatory pressure on how it is handled.

What do the Citrix, Windows and MikroTik CVEs indicate together?

Together they show three different attack surfaces, edge appliances, operating systems and widely used routers, with active exploitation in the same month. That makes patching and segmentation a priority, because the risk was not concentrated in one vendor or one type of infrastructure.

How does the malicious email campaign connect to Mexican digital banking?

Proofpoint's campaign sought credentials and initial access through everyday lures, while digital banking showed alerts tied to mobile malware, clones of institutions and code theft. They are different fronts, but they meet in the same chain, social engineering, access capture and later fraud.

Which sectors should pay the most attention after September?

Financial services, government, industry and utilities are the most exposed based on what the sample showed. Finance for fraud and regulation, government for unclassified incidents and extortion pressure, and critical infrastructure for multivertical campaigns and exploited vulnerabilities in exposed systems.

Material limitations

This report covers only facts dated September 2026 within the provided material. One fact without a confirmed date was excluded from the indicators, and one fact after the period was also excluded from the count. When numbers appear in prose, they refer to the base of 61 verified facts from the period.

A zero indicator, especially in the documented fraud or phishing cases, means those items did not appear in the material reviewed for this cut, not that they did not occur in Mexico or the region. The same applies to the nuance on CVEs: the 6 critical vulnerabilities mentioned do not exhaust the full universe of exploited flaws, only what was observed in the month's sources.

The indicator window included 62 facts dated September 2026, plus 1 without a confirmed date that was excluded and 1 after the period that was excluded. Facts from earlier months were used only for comparison when the material allowed it, never as part of the month's volume.

The base excluded attempts, blocks, or aggregated scans that the material treated as telemetry, because they do not amount to incidents with confirmed impact. Sponsored content, commercial releases, and notes without enough support to turn them into a trend were also left out.