MexicanMafia SOCKS5 Exfil Callback to 200.79.113.136 or 201.144.122.60 via Wget/1.18

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.