Mexican drug cartels

Profile narrative

Mexican drug cartels, also referred to simply as drug traffickers, operate primarily from Mexico and have been observed targeting law enforcement assets along the United States‑Mexico border. Their activities focus on unmanned aerial vehicles used by the U.S. Customs and Border Protection agency, which patrol the border to detect illegal crossings. The strategic objective demonstrated in these incidents is to facilitate the smuggling of narcotics and other contraband by removing aerial surveillance, thereby serving a financial motive tied to their drug trafficking enterprises. No explicit mention of espionage or disruption goals appears in the source material.

The tactics, techniques, and procedures described involve GPS spoofing, a method whereby false GPS signals are transmitted to the receivers aboard the drones. This interference causes the unmanned aircraft to receive erroneous location data, prompting them to deviate from their programmed patrol routes and follow misleading coordinates. The attackers rely on the absence of anti‑GPS‑spoofing hardware in the smaller, budget‑constrained drones used by border patrol, exploiting this vulnerability to create a repeated course‑correction loop that drains the drone’s fuel or forces it to leave the area long enough for smugglers to pass. No malware families, specific initial access vectors, or particular tooling suites are referenced beyond the GPS spoofing technique itself.

Attribution to the Mexican drug cartels is based on public reporting that links the drone interference to drug trafficking operations seeking to move goods across the border. The sources do not indicate any state sponsorship or formal affiliation with governmental entities, characterizing the actors as a criminal consortium driven by profit. A representative example of their activity is the series of incidents reported by the U.S. Department of Homeland Security and U.S. Customs and Border Protection in which drones were deliberately misdirected via GPS spoofing to allow traffickers to cross the border undetected, illustrating a concrete operation that has been publicly acknowledged.

Incidents

Attributed incidents are available to members.