Cyberattacks in Mexico Surge 65%, Targeting Key Infrastructure

Cyberattacks in Mexico increased 65% in 1Q25 compared to last year, reveals SILIKN. The organization also reports a notable increase in vulnerabilities in critical infrastructures. Malicious actors primarily exploit unpatched software vulnerabilities as their main access method, risking the operation of the country's essential services.

The increase in malicious activity comes as a direct response to the accelerated digitalization of the Mexican economy, says Carlos Torales, Vice President for Latin America, Cloudflare. “The internet is growing at 23%, while the economy is growing at 1%. That means Mexico is quickly becoming a digital economy, which makes it a more coveted target for cybercriminals,” says Torales to El Economista.

Critical systems, such as power grids, water systems, health services, and transportation systems, have become a priority target for a diverse spectrum of actors, from state-sponsored groups to ransomware organizations and opportunistic cybercriminals, reports Tarlogic. The objective of these attacks is not only financial gain but also large-scale service disruption, with the potential for severe economic and social consequences.

“Recent evidence shows that cyberattacks against critical infrastructures are used to undermine the functioning of Western states by nations such as Iran, Russia, North Korea, or China; and as a weapon in military conflicts,” reports Tarlogic. “For this reason, public authorities in the United States, the United Kingdom, and the European Union, have alerted energy and water treatment and supply companies to the need for advanced cybersecurity services to improve their resilience against cyberattacks on critical infrastructure.”

During 1Q25, Mexico experienced over 1.77 billion cyberattack attempts, reports El Economista. This figure translates to an average of 59 million attacks daily and represents a 65% growth compared to the previous quarter.

The vast majority of these threats do not originate within the country. Data from Cloudflare indicates that just 5% of malicious attacks are launched from within Mexico; the remaining 95% comes from abroad, mainly from the United States, Brazil, China, Russia, and various Eastern European nations. This global nature of threats highlights the complexity of defense, as an attack can be triangulated through servers in multiple countries before reaching its final target in Mexico, such as with denial-of-service (DDoS) attacks.

The Primary Attack Vector: Software Vulnerabilities

The preferred methodology for attackers is the exploitation of known software vulnerabilities. According to a report from SILIKN's research unit, 2024 saw a 55.9% increase in attacks that leveraged vulnerabilities for which security patches already existed. The delay in applying these updates by organizations is the main factor that enables attacker success.

Industrial control systems (ICS), prevalent in sectors such as energy and manufacturing, are particularly susceptible. Designed decades ago without modern cybersecurity standards in mind, these systems present a broad and unprotected attack surface. Data from SILIKN shows that 71.1% of security incidents reported in critical infrastructure during 2024 involved the exploitation of flaws in ICSs.

Some of the most exploited vulnerabilities against government and critical infrastructures worldwide between 2018 and 2025, according to SILIKN, are:

• CVE-2019-19781 (Citrix ADC and Gateway): A critical vulnerability that allows remote code execution without authentication. Its exploitation facilitates total control of exposed systems and was used against government organizations globally.

• CVE-2019-11510 (Pulse Secure VPN): This vulnerability allows unauthenticated access to virtual private networks, compromising credentials and sensitive data. The lack of patching on VPN systems in Mexico facilitated infiltration into critical networks.

• CVE-2018-13379 (Fortinet VPN): A path traversal vulnerability that exposes sensitive system files. Its use was reported in attacks against the energy and finance sectors in Mexico.

• ProxyShell (Microsoft Exchange): A set of three vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) that, when chained, permit remote code execution. Its exploitation was responsible for the cyberattack on the Ministry of National Defense (SEDENA) in 2022, which resulted in the leakage of 6TB of data.

• CVE-2025-21418 (Windows Server): This flaw allows for privilege escalation through a buffer overflow, granting administrative control over vulnerable systems and potentially affecting thousands of Mexican institutions.

• CVE-2025-21376 (Windows Server LDAP): A zero-day vulnerability that enables remote code execution in critical services like Active Directory, a central component in most government and corporate infrastructures.

Underlying Systemic Factors

Beyond technical vulnerabilities, several structural conditions aggravate the risk, says Víctor Ruiz, Founder, SILIKN. Ruiz adds that obsolete technology systems no longer receive technical support or security updates, leaving them highly exposed. Additionally, there is a widespread deficiency in patch management, with organizations often slow to apply necessary updates. 

Another key factor is the shortage of cybersecurity specialists, says the Superior Audit Office of the Federation (ASF) Compounding these issues is an insufficient regulatory framework, as Mexico does not have specific federal legislation on cybersecurity. While a new cybersecurity law has been proposed, its full implementation remains pending. 

The democratization of attack tools has significantly raised the threat level. Furthermore, the availability of exploit kits on the dark web means that even actors with limited technical skills can now execute sophisticated attacks.

Attack vectors continue to evolve. DDoS attacks recorded a 358% global growth in the last year, reports Cloudfare. In April 2025, Cloudflare mitigated the largest DDoS attack in history, with a magnitude of 6.5TB per second. These attacks do not always have a financial motive, but their operational impact is just as significant.

Generative AI (GenAI) has also become a new battleground. Between February 2024 and March 2025, traffic to Gen AI services grew 251%. Over 80% of attacks on these services target chatbots.

Projections indicate that the volume of attacks will not decrease, says Mordor Intelligence. Mexico's continued digital expansion ensures it will remain an attractive target. The telecommunications, cryptocurrency platforms, education, and recruitment services sectors are expected to remain among the most attacked.

Strategic Recommendations

To mitigate these growing threats, the SILIKN research unit recommends adopting a proactive, multi-layered security approach. This includes implementing a rigorous and agile vulnerability and patch management program that prioritizes the remediation of critical risks according to the Common Vulnerability Scoring System (CVSS). 

Network segmentation is also essential, as it allows organizations to isolate operational technology (OT) systems and other critical assets from information technology (IT) networks, helping contain potential intrusions. Continuous training and awareness are equally important; personnel must be prepared to identify and report phishing and social engineering attempts, which are common entry points for more complex attacks.

Finally, the deployment of real-time monitoring and detection tools, such as intrusion detection systems (IDSs), security information and event management (SIEM) platforms, and behavior analytics, is crucial to identifying anomalous activity at an early stage and responding effectively.