The New Criminal Battlespace South of the Border
CJNG violence in Puerto Vallarta following the death of Nemesio Rubén Oseguera Cervantes (“El Mencho”) – Feb, 2026
People still talk about “the cartels” like they are fixed organizations. That works on paper. In practice, it breaks fast. What exists now is a shifting ecosystem of factions, brokers, enforcers, financiers, and local power structures—connected when it makes sense, violent when it doesn’t. This is what that actually looks like.
Bottom Line Up Front
Mexican transnational criminal organizations are not collapsing. They are mutating. That matters.
See the interactive brief
Jump to indicators and warnings (I&W)
The old picture — a few big cartels moving drugs through known plazas, led by recognizable bosses, using violence to protect routes — is still partly true. But it is no longer enough. The current environment is more fragmented, more technical, more financially sophisticated, and more global than the standard cartel narrative suggests.
In cartel terms, a plaza is not just a city or crossing point. It is a controlled criminal operating area, usually tied to a border crossing, port, highway corridor, city, or logistics hub. Plazas are where cartels or factions tax movement and decide who gets permission to move drugs, people, weapons, cash, fuel, or legal goods.
Sinaloa is no longer the stable federation it once was. The fight between Los Chapitos and the Zambada-aligned Mayiza network has turned one of Mexico’s most important criminal systems inward, redrawing alliances across Sinaloa, Sonora, Zacatecas, and beyond. CJNG remains the most aggressive paramilitary-style cartel in the country, but its own future depends on whether its franchise model can survive leadership uncertainty and regional commander independence. Smaller groups — Gulf Cartel factions, Cartel del Noreste, La Nueva Familia Michoacana, Carteles Unidos, local armed cells — are not background noise. They are the connective tissue of the fight.
New Authorities, New Problems
The United States has also changed the frame. In February 2025, the State Department designated several cartels and transnational gangs as Foreign Terrorist Organizations, including the Sinaloa Cartel, CJNG, Cartel del Noreste, Cartel del Golfo, La Nueva Familia Michoacana, Carteles Unidos, Tren de Aragua, and MS-13. That move did not magically turn cartel violence into ideology-driven terrorism. But it did change authorities, legal exposure, collection priorities, interagency posture, and the political ceiling for action.
The core problem for the IC is this: Mexican TOCs now behave less like traditional smuggling organizations and more like hybrid criminal systems. They manufacture, govern, launder, recruit, intimidate, surveil, innovate, and adapt. They exploit weak states, commercial supply chains, encrypted communications, drone technology, social media, diaspora finance, and legitimate markets.
That is not a border problem.
That is an intelligence problem.
The Cartel Map Is Fragmenting, Not Simplifying
The biggest mistake analysts can make right now is treating “the cartels” as a clean set of fixed organizations.
That works on a whiteboard. In practice, it breaks fast.
Mexico’s criminal environment is now a layered ecosystem of legacy cartels, splinter factions, plaza bosses, armed wings, local gangs, corrupt officials, business fronts, chemical brokers, financial facilitators, logistics nodes, and social control networks. Some fly a cartel brand. Some rent the brand. Some only align when it is useful.
Sinaloa is the clearest example. For years, its strength came from federation. Different family blocs could share logistics, routes, protection, and corruption networks without needing a single rigid chain of command. That made it resilient. Remove one boss, and the system could keep breathing.
That equilibrium is now badly damaged.
The arrest of Ismael “El Mayo” Zambada in July 2024 accelerated a fight between Los Chapitos, tied to the Guzmán family, and Mayiza elements loyal to the Zambada family. ACLED assessed in 2025 that the Sinaloa rift was redrawing Mexico’s criminal map and opening space for new conflict in contested territories.
In plain terms: one of Mexico’s most important trafficking machines is fighting itself while everyone else watches for openings.
That does not mean Sinaloa is finished. Criminal organizations rarely die cleanly. They split, rebrand, subcontract, and bleed into the terrain. The more likely outcome is a Sinaloa system that becomes less centralized, more violent, and more dependent on local commanders and opportunistic alliances.
That is usually where the map gets ugly.
CJNG Is Still the Big Hammer
CJNG remains the most militarized and expansionist cartel in Mexico. DEA’s 2025 National Drug Threat Assessment identifies Sinaloa and CJNG as the two dominant Mexican-based cartels driving the synthetic drug crisis in the United States.
But the February 2026 killing of Nemesio Oseguera Cervantes (“El Mencho”) changes the operating environment.
Mexican authorities confirmed El Mencho’s death after a military operation in Jalisco, with follow-on reporting noting that his body was returned to his family after genetic confirmation. The killing triggered retaliatory violence across wide parts of Mexico and immediately raised the central question hanging over CJNG: whether the organization can hold together without the personality, fear, and arbitration power of its founding boss.
This does not mean CJNG collapses tomorrow.
That is the lazy read.
But Mencho’s Death Changes the Math
The more likely near-term outcome is a managed succession attempt paired with violent signaling. CJNG has enough structure, money, armed capacity, and local franchise depth to survive the loss of one leader. But survival is not the same thing as stability. Without Mencho, regional commanders have more room to maneuver, rivals have more incentive to test boundaries, and internal disputes become harder to settle quietly.
In plain terms: CJNG may remain powerful while becoming less disciplined.
That matters for the broader TOC environment. A weakened or contested CJNG could invite Sinaloa factions, Gulf remnants, Cartel del Noreste, and regional actors to probe CJNG-held plazas, ports, extortion markets, and trafficking corridors. A stable succession could preserve CJNG’s national reach. A messy succession could push Mexico into another round of localized wars where smaller factions align, defect, or freelance depending on who looks strongest that week.
For the IC, Mencho’s death should be treated less like a decapitation success story and more like a network stress test.
The key indicators are not just who claims leadership. Watch who controls revenue, who commands armed wings, who keeps access to chemical supply chains, who maintains corruption channels, and who can prevent local franchise bosses from acting like independent warlords.
That is where the real succession fight will show up.
The Border Is a Marketplace, Not Just a Line
The U.S.-Mexico border is not just a smuggling corridor. It is a contested commercial environment.
Cartels do not only move drugs across it. They tax movement, control plazas, monitor law enforcement patterns, exploit commercial traffic, move people, move cash, move weapons, and use border friction as a business model.
A plaza is not just a crossing point. It is a revenue node.
Tijuana, Ciudad Juárez, Nuevo Laredo, Reynosa, Matamoros, and other border areas matter because they combine routes, infrastructure, corruption access, human terrain, and proximity to U.S. markets. Control the plaza and you do not need to own every shipment. You can tax every shipment. Drugs, migrants, counterfeit goods, fuel, weapons, people — all of it becomes chargeable.
That is the part people miss.
Cartel violence is not always random chaos. Often it is accounting with rifles. Who controls the plaza? Who pays the tax? Who gets permission? Who is protected? Who failed to pay? Who is sending a message?
Nuevo Laredo is especially important because of its commercial value and the presence of Cartel del Noreste. NCTC identifies CDN as a splinter of Los Zetas and notes its role in narcotics trafficking, human trafficking, arms trafficking, money laundering, kidnapping, and extortion.
For analysts, the border should be read as an integrated operating environment. Not just southbound guns and northbound drugs. Watch commercial flows, port congestion, bridge traffic, local police movement, plaza violence, migrant exploitation, drone sightings, and changes in cartel propaganda.
The border talks. Not always clearly, but it talks.
Synthetic Drugs Changed the Business Model
Fentanyl and methamphetamine changed cartel economics.
Cocaine and heroin require geography, agriculture, production cycles, and long logistics chains. Synthetic drugs require chemicals, equipment, recipes, protection, and distribution. That shift lowered barriers, increased profit density, and made supply chains harder to disrupt through traditional interdiction alone.
DEA’s 2025 assessment identifies Mexican cartels — primarily Sinaloa and CJNG — as central drivers of the U.S. synthetic drug threat, especially fentanyl and methamphetamine.
Fentanyl is operationally attractive because small quantities generate massive revenue. That makes concealment easier, shipment risk lower, and retail distribution more flexible. Methamphetamine remains a major profit stream because industrial production can scale when precursor access is stable.
This is why precursor control matters.
The fight is not only at the border. It is in chemical procurement, shell companies, customs paperwork, mislabeled cargo, online brokers, front businesses, and payment rails. Treasury’s April 2026 sanctions against a synthetic opioid procurement network tied to the Sinaloa Cartel described chemical suppliers and brokers as key actors enabling Mexican cartels to synthesize drugs from precursor chemicals imported primarily from Asia.
That is the operational center of gravity. Not the baggie on the street. The supply chain behind it.
The China-Mexico Axis Is About Chemicals and Money
China’s role is often flattened into “Chinese precursors.” That is true, but incomplete.
The more important frame is this: Chinese-linked networks provide two things Mexican TOCs need badly — chemical access and financial movement.
On the chemical side, suppliers and brokers can adapt faster than regulators. Schedule one precursor, and networks pivot to pre-precursors, alternate synthesis routes, mislabeled industrial shipments, and new intermediaries. This is classic adversary adaptation. Shut one door, they use the loading dock.
On the finance side, Chinese money laundering networks have become a major enabler of cartel cash movement. FinCEN issued an advisory in August 2025 warning financial institutions about Chinese Money Laundering Networks and their connection to Mexico-based cartels, including FTO-designated groups. The advisory specifically addresses typologies and red flags tied to laundering cartel proceeds.
The mechanism is elegant in the worst possible way.
Cartel cash in the United States is matched with Chinese nationals or businesses seeking U.S. dollars outside formal currency controls. Dollars move domestically. Value moves through parallel channels. Equivalent funds can then be used to pay chemical suppliers, purchase goods, or settle accounts. The money does not have to cross borders in the old-school way.
That makes FININT harder.
It also means cartel finance is not just a Mexican problem. It touches U.S. cash markets, Chinese capital controls, trade-based laundering, crypto rails, shell firms, casinos, real estate, logistics companies, and legitimate import-export activity.
This is where the spreadsheet starts bleeding into the battlefield.
Africa Is Becoming a Manufacturing Workaround
One of the most important emerging shifts is the reported movement of Mexican-linked drug manufacturing into Africa, especially for methamphetamine.
The logic is straightforward. If producing in Mexico creates pressure from U.S. and Mexican security services, move production closer to other markets and exploit weaker monitoring environments. South Africa and Nigeria offer access to ports, commercial cover, chemical imports, corruption opportunities, and onward routes into Europe, Asia, and other markets.
That does not mean Mexico stops mattering. It means Mexican TOCs are building redundancy.
A cartel that can manufacture in Mexico, source from Asia, launder through Chinese-linked brokers, move cocaine through South American partners, and establish industrial production abroad is no longer just a border cartel. It is a transnational criminal enterprise with distributed production.
For the IC, this matters because border seizures may no longer reflect total organizational health. A cartel can lose product at the U.S. border and still expand elsewhere. Interdiction can look successful while the enterprise adapts around it.
That is the trap.
If collection stays border-centric while production globalizes, analysts will be watching the wrong end of the machine.
Cartels Are Moving Into Criminal Governance
Cartels do not only traffic commodities. In some areas, they govern.
That word makes people uncomfortable, but it fits.
In parts of Michoacán, Guerrero, Tamaulipas, Zacatecas, and elsewhere, criminal groups regulate movement, tax legal businesses, influence local politics, settle disputes, punish rivals, and decide who gets to operate. They do this through fear, money, corruption, selective services, and local dependency.
La Nueva Familia Michoacana, Carteles Unidos, CJNG-linked actors, Gulf factions, and other regional groups have all shown versions of this model. In some areas, extortion of agriculture, mining, logging, transportation, and retail markets matters as much as drugs.
That is how a cartel becomes harder to target.
A lab can be raided. A convoy can be hit. A shipment can be seized. But criminal governance is embedded. It lives inside local business, police relationships, municipal politics, family ties, fear, and survival economics.
This is where analysts need to slow down.
A spike in avocado extortion, fuel theft, mining intimidation, or local candidate assassinations may tell you as much about cartel posture as a drug seizure does. Maybe more.
The cartel is not always where the narcotics are.
Sometimes it is where the tax is.
Fast Adoption of Lessons from Europe
Dropped munition and strike from loitering cartel quadcopter on rival camp
Drones Are Now Part of the Cartel Toolkit
Drones have moved from novelty to standard cartel tradecraft.
At the border, cartels use them for reconnaissance, route surveillance, counter-law-enforcement activity, and small-load delivery. Inside Mexico, drones support intimidation, spotting, attacks, and tactical coordination.
The key point is not that cartels discovered drones.
Everyone discovered drones.
The key point is how quickly cartel use is moving toward battlefield logic: cheap airframes, expendable systems, FPV control, improvised munitions, electronic countermeasures, and rapid iteration.
For U.S. border security, this creates an uncomfortable asymmetry. Cartels do not need air superiority. They only need enough cheap eyes in the air to spot patrol gaps, test response times, move high-value loads, and keep pressure on enforcement.
That is a low bar.
For the IC, drones are not just a tactical nuisance. They are an indicator of organizational learning. Drone teams, jammers, fiber-optic systems, modified payloads, or trained pilots all point to technical maturity, foreign knowledge transfer, procurement networks, and command discipline.
The drone is not the story.
The learning network behind it is.
Shrine to Santa Muerta – DOJ Exhibit US v Jose Arzata-Garcia
The U.S. Counterterrorism Frame Changes the Game
The 2025 FTO designation is a major policy shift. It creates new pressure points, new authorities, and new risks.
It gives U.S. agencies more tools for financial targeting, material-support exposure, sanctions pressure, intelligence prioritization, and action against facilitators, brokers, front companies, and support networks.
But there is a catch.
Cartels are not terrorist organizations in the classic ideological sense. Their primary motivation is profit, power, survival, and territorial control. They use terror as a method, not necessarily as a doctrine.
Different beast. Some similar tools.
The FTO framework should help analysts target cartel support architecture: money movers, chemical brokers, arms suppliers, corrupt officials, safehouse networks, drone procurement, logistics companies, and legal-business cover.
But it should not replace criminal-enterprise analysis with a copy-paste CT model.
That would be a staff-work crime.
The right approach is hybrid: CT authorities, organized crime methodology, financial targeting, border intelligence, human terrain analysis, and serious partner-nation sensitivity. Mexico is not an ungoverned battlespace. It is a sovereign neighbor with deep economic, political, and social ties to the United States.
Every intelligence gain sits inside that reality.
What This Means for the U.S. Intelligence Community
The U.S. IC needs to stop treating Mexican TOCs as a narrow law enforcement target set.
That does not mean law enforcement is irrelevant. It means the target has outgrown a law-enforcement-only frame.
Modern Mexican TOCs touch homeland security, public health, sanctions enforcement, cyber-enabled fraud, trade integrity, port security, border surveillance, migration flows, and great-power-adjacent supply chains.
That is a lot of lanes.
And yes, everyone will claim they own part of it. That is how the interagency buffet gets weird.
The intelligence requirement should stay simple: understand the enterprise, not just the incident.
A seizure is an incident. A shootout is an incident. A drone sighting is an incident. A murdered local official is an incident. A shell company importing industrial chemicals is an incident.
The enterprise is the network connecting them.
That is where intelligence earns its paycheck.
Intelligence Discipline Breakdown
OSINT: The Cartels Are Loud, Even When They Think They Are Being Clever
OSINT is one of the most useful disciplines for tracking cartel dynamics because cartels, communities, journalists, officials, and armed factions constantly leak signals into the open.
Narco-banners, Telegram channels, TikTok clips, funeral videos, convoy footage, local news, missing-person networks, business closures, roadblock reports, and municipal chatter all matter.
None of it should be swallowed whole. Cartel media is often staged, manipulated, or designed to intimidate. But it still reveals posture.
OSINT can help identify emerging plaza disputes, faction rebranding, convoy movement, drone tactics, propaganda shifts, intimidation campaigns, local economic targeting, public reaction to state operations, and violence spillover patterns.
The analyst’s job is not to believe the internet.
The job is to exploit it carefully.
Baseline first. Then anomalies.
SIGINT: Encryption Is the Problem. Pattern Life Is the Opportunity.
Cartels use encrypted apps, burner devices, radios, cellular infrastructure, Wi-Fi, satellite devices, and layered communication habits depending on role, region, and pressure.
Content access will remain hard. That does not make SIGINT useless. It shifts the value toward externals: timing, location, device movement, network behavior, call patterns, emitter correlation, and shifts in communications discipline before or after operations.
In cartel work, SIGINT has to be fused tightly with HUMINT, GEOINT, and OSINT. A single encrypted device may not tell the story. A cluster of devices moving with a convoy, going dark near a plaza, and reappearing after a killing might.
That is the tradecraft.
Do not worship content. Behavior matters.
GEOINT: Labs, Routes, Terrain, and Economic Control
GEOINT is central because cartel power is territorial.
Labs need concealment, road access, water, chemicals, power, waste disposal, security, and transport. Plazas need chokepoints. Fuel theft needs pipeline access. Illegal mining needs terrain and equipment. Human smuggling needs staging areas, safe houses, guides, and crossing windows.
GEOINT can help map clandestine lab signatures, roadblock patterns, remote airstrips, tunnel indicators, fuel theft infrastructure, illegal mining expansion, checkpoints, drone launch sites, border staging areas, and shifts in commercial cargo routes.
The mistake is treating GEOINT as “find the lab.”
That is too narrow.
GEOINT should explain how the network uses terrain.
HUMINT: Fragmentation Creates Access, But Also Risk
Fragmentation creates openings.
When cartels split, people get scared. Middlemen lose protection. Corrupt officials hedge. Logistics coordinators change patrons. Local gangs wonder who will win. Rivals look for leverage.
That is access.
But cartel HUMINT is dangerous and messy. These organizations understand informant risk. They use intimidation, surveillance, lookouts, corrupted police access, social media monitoring, and increasingly cameras or drones to identify patterns.
Good HUMINT here requires patience, compartmentation, source protection, and deep local knowledge. It also requires humility. Cartel sources may be truthful on one issue and manipulative on the next.
That does not make them useless.
It makes validation mandatory.
FININT: Follow the Value, Not Just the Cash
Cartel finance is no longer just bulk cash smuggling.
Bulk cash still matters. But so do Chinese money laundering networks, trade-based laundering, shell companies, crypto, casinos, real estate, front businesses, luxury goods, fuel markets, agricultural exports, and professional service providers.
FININT indicators worth watching include import-export firms tied to chemicals or pharmaceuticals, mismatched invoices, U.S. cash aggregation linked to Chinese brokers, low-margin trade activity with no clear business logic, crypto wallets tied to precursor procurement, fuel-market anomalies, real estate near logistics nodes, and shell networks supported by lawyers, accountants, or brokers.
Cartel finance is not just where the money goes.
It is where the organization breathes.
MASINT: The Underused Toolset
MASINT has real value against labs, tunnels, drones, and industrial activity.
Chemical production creates signatures: waste, heat, power usage, odors, emissions, unusual transport rhythms, and disposal patterns. Tunnel activity can produce seismic or acoustic indicators. Drone activity can create RF, acoustic, thermal, or flight-pattern signatures.
This is not magic.
It requires cueing, baselining, and fusion. MASINT without context can drown analysts in weirdness. MASINT fused with OSINT, GEOINT, SIGINT, and law enforcement reporting can help find activity other disciplines only partially see.
Quiet signatures. Dirty environment. High payoff.
CYBINT: The Digital Back Office Is a Target Set
Cartels use the digital world for recruitment, intimidation, fraud, procurement, coordination, laundering, and market access.
Cyber-enabled fraud, online chemical procurement, social media propaganda, encrypted coordination, and digital surveillance are all part of the modern cartel portfolio.
CYBINT should focus on the back office: chemical broker platforms, encrypted marketplace behavior, fraud infrastructure, phishing and account takeover patterns, cartel-linked crypto use, drone procurement channels, compromised municipal systems, social media influence networks, and digital intimidation campaigns.
Cartels do not need to become elite cyber actors to use the internet effectively.
They just need enough capability to make money, hide movement, and scare people.
They already have that.
Key Indicators and Warnings for the U.S. IC
1. Sinaloa Fragmentation Becomes Permanent
Watch for sustained separation between Chapitos and Mayiza logistics, branding, financial channels, armed wings, and foreign suppliers.
If the factions build independent supply chains, the old Sinaloa federation is not just wounded. It is being replaced.
2. CJNG Regional Commanders Start Acting Like Cartel Bosses
CJNG can survive leadership uncertainty if regional commanders stay aligned. If they begin cutting independent deals, fighting each other, or withholding revenue, the franchise model could crack.
That would not reduce violence.
It would redistribute it.
3. Drone Use Moves From Surveillance to Integrated Operations
A drone dropping a package is one thing. Drone reconnaissance paired with ground movement, jamming, convoy overwatch, attacks, and counter-law-enforcement timing is another.
The warning sign is integration.
4. Jam-Resistant Drone Systems Appear Near the Border
If cartel drone teams field fiber-optic or other jam-resistant systems near the border, the counter-UAS problem changes fast.
That would suggest battlefield learning, improved procurement, or both.
5. Synthetic Drug Production Moves Beyond Mexico at Scale
Mexican-linked industrial labs in Africa, Southeast Asia, or the Balkans would signal a shift from route protection to distributed global manufacturing.
Border interdiction would become a weaker measure of total cartel capacity.
6. Nitazenes Enter Cartel Production Streams
A move from fentanyl dominance toward nitazenes or other high-potency synthetics would signal adaptation under pressure and a potentially worse public-health threat.
That kind of shift can look small in seizure data before it shows up big in overdose data.
7. Chinese Money Laundering Networks Shift Rails
If CMLNs move away from mirror transactions toward privacy coins, DeFi, layered crypto swaps, or more opaque trade systems, FININT visibility will suffer.
That would force a collection reset.
8. Cartels Target Mexican Investigative Capacity
Watch attacks on prosecutors, forensic labs, financial investigators, telecom-data units, judges, and police intelligence cells.
When cartels target investigative infrastructure, they are not just retaliating.
They are protecting the nervous system.
9. U.S. Direct Action Becomes More Thinkable
The FTO framework creates space for more aggressive options. Any move toward direct U.S. kinetic action in Mexico would be a strategic rupture point.
Even the rumor of it can affect cartel behavior, Mexican politics, bilateral cooperation, and propaganda.
10. Legal Economies Become Main Battlefields
Mining, fuel, agriculture, ports, transportation, and construction are not side hustles.
They are cartel terrain.
When violence shifts into legal sectors, analysts should treat it as governance competition, not just organized crime.
What Junior Analysts Should Take Away
Do not reduce Mexican TOCs to drug routes.
That is the rookie trap.
The better frame is this: Mexican TOCs are adaptive criminal systems competing for control of value. Drugs are the engine, but the machine includes territory, ports, people, chemicals, money, political access, fear, legitimacy, and information.
If you are an analyst, map how the machine works.
Who supplies chemicals? Who protects labs? Who moves money? Who controls the plaza? Who owns the trucking company? Who pays the police commander? Who posts the propaganda? Who benefits when a rival cell gets hit? Who can still operate after a seizure?
Most important: who adapts fastest?
That cartel usually survives.
Our Assessment
Mexico’s cartel environment is entering a more dangerous phase because the major organizations are becoming less predictable at the same time they are becoming more capable.
Sinaloa’s internal war is weakening old command arrangements and creating new violent actors. CJNG remains powerful but faces succession and franchise-control pressure. Regional groups are becoming criminal governors. Synthetic drugs keep the money flowing. Chinese-linked finance and precursor networks keep the system connected. Drones and encrypted communications are raising the technical floor. Overseas manufacturing may reduce the value of border-centric metrics. The U.S. FTO designation adds pressure, tools, and risk.
The center of gravity is not one boss. It is the network. And the network is learning.
For the U.S. IC, the priority should be enterprise-level understanding: cartel structure, supply chains, financial architecture, technical adaptation, territorial control, and political protection. The disciplines cannot work this in stovepipes. OSINT finds the noise. SIGINT tracks behavior. GEOINT maps the ground. HUMINT explains intent. FININT exposes the bloodstream. MASINT catches signatures the eye misses. CYBINT follows the digital back office.
That is how this target set has to be worked. Not as a drug problem. Not as a border problem.
As a living, adapting, armed criminal ecosystem sitting inside the U.S. homeland security picture.
And it is closer than most people want to admit.