Cyber Threat Actor: Mexican drug cartels

Mexican drug cartels, also referred to by their alias of Mexican drug cartels, operate primarily from Mexico and have been observed targeting law enforcement assets along the United States‑Mexico border. Their activities focus on unmanned aerial vehicles used by the U.S. Customs and Border Protection agency, which are employed to patrol the border and detect illegal crossers. The strategic objective demonstrated in the reported incidents is to facilitate the smuggling of narcotics across the border, thereby advancing the cartels’ financial interests in drug trafficking. This objective is explicitly tied to the need to remove aerial surveillance that would otherwise interdict their smuggling routes. No evidence in the source material indicates espionage or disruption as a primary motive beyond the immediate goal of enabling contraband movement.

The tactics, techniques, and procedures described involve GPS spoofing, a method whereby false GPS signals are transmitted to the drones’ receivers, causing the aircraft to calculate incorrect positions and deviate from their programmed patrol paths. The cartels employ a GPS jammer‑spoofing device positioned near the border to generate the counterfeit satellite data, which the drones interpret as legitimate and respond to by altering course. This technique does not rely on malware families or traditional cyber intrusion tools; instead, it exploits a known vulnerability in the drones’ navigation systems by manipulating the external signal environment. The tooling style is therefore characterized by the use of portable radio frequency equipment capable of overriding genuine GPS signals within a localized area. Attribution to the cartels is based on public reporting that links the spoofing activity to drug traffickers seeking to secure safe passage for their shipments.

A notable publicly reported operation occurred when U.S. Department of Homeland Security and Customs and Border Protection officials observed drug traffickers using GPS spoofing to divert Border Patrol drones away from their surveillance zones, allowing smugglers to cross the border undetected until the drones exhausted their fuel or the jammers were deactivated. This incident illustrates the cartels’ capacity to adapt readily available technology to counter law enforcement surveillance, representing a concrete example of their operational approach. The episode remains the primary documented case of the cartels employing cyber‑enabled tactics to support their smuggling activities, with no additional campaigns detailed in the provided source.