Insights on Cyber Threats Targeting Users and Enterprises in Mexico

Written by: Aurora Blum, Kelli Vanderlee

---

Like many countries across the globe, Mexico faces a cyber threat landscape made up of a complex interplay of global and local threats, with threat actors carrying out attempted intrusions into critical sectors of Mexican society. Mexico also faces threats posed by the worldwide increase in multifaceted extortion, as ransomware and data theft continue to rise.

Threat actors with an array of motivations continue to seek opportunities to exploit the digital infrastructure that Mexicans rely on across all aspects of society. This joint blog brings together our collective understanding of the cyber threat landscape impacting Mexico, combining insights from Google’s Threat Analysis Group (TAG) and Mandiant’s frontline intelligence. By sharing our global perspective, especially during today’s Google for Mexico event, we hope to enable greater resiliency in mitigating these threats.

Cyber Espionage Operations Targeting Mexico

As the 12th largest economy in the world, Mexico draws attention from cyber espionage actors from multiple nations, with targeting patterns mirroring broader priorities and focus areas that we see elsewhere. Since 2020, cyber espionage groups from more than 10 countries have targeted users in Mexico; however, more than 77% of government-backed phishing activity is concentrated among groups from the People’s Republic of China (PRC), North Korea, and Russia.

<div class="article-module h-c-page">
  <div class="h-c-grid">


<figure class="article-image--large


    h-c-grid__col
    h-c-grid__col--6 h-c-grid__col--offset-3


  ">




    <img alt="Government-backed phishing activity targeting Mexico" src="https://storage.googleapis.com/gweb-cloudblog-publish/images/threats-tar