Key Findings

• Following the successful Mexican special forces operation that killed Mexico’s top cartel leader, Nemesio Oseguera Cervantes (AKA El Mencho), retaliatory acts of violence are likely to continue over the coming weeks to dissuade further counter-narcotics operations. 
• Mexico’s residents are the primary victims of cartel-related crime, and deliberate targeting of Westerners is rare; however, retaliatory cartel violence in major Mexican cities will likely injure or kill innocent bystanders. 
• Mexican President Claudia Sheinbaum will likely continue facing pressure from the United States and her citizens concerned over crime and the risk of a cartel-inspired wave of violence ahead of Mexico hosting World Cup 2026. Previous Mexican presidents have pursued tougher-on-crime policies, only to abandon the approach once the security situation deteriorated.

Details

On February 22, 2026, Mexican special forces killed the leader of Cártel de Jalisco Nueva Generación (CJNG), known as “El Mencho”, in Tapalpa in the central-western state of Jalisco. The attack was reportedly conducted using U.S.-supplied intelligence.¹ Following the operation, retaliatory acts of violence were carried out starting at the nearby tourist hub of Puerto Vallarta, as well as in the nearby city of Guadalajara. 

Dozens of trucks and buses were torched (narco bloqueos) during the initial special forces operation to thwart cartel security forces. However, once the operation was complete, there were hundreds of acts of violence in parts of the country where CJGN operates.² Similar acts of violence are common following operations against cartel leaders, and they are likely to continue over the coming weeks to dissuade further counter-narcotics operations. 

• Various rival drug cartels—including Los Zetas, Gulf Clan, CJNG, and Sinaloa Cartel—are responsible for the majority of the crime in Mexico.³ Over the longer term, turf wars between remaining elements of CJGN and rival cartels looking to take over are almost certain.

Mexico has deployed thousands of additional soldiers and security personnel to contain the wave of violence across at least 20 states.⁴ Security operations and cartel-related acts of crime continue to occur predominantly in the states of Jalisco⁵ and areas of Guanajuato, Guerrero, and Michoacán.⁶

Analyst Commentary

Politics

Such attacks very likely aim to demonstrate cartel strength—either to security forces or rival cartels. Critics suggest that Mexico’s previous president, Andrés Manuel López Obrador (AMLO), reached an unspoken truce that allows cartels certain economic legitimacy in some sectors in exchange for a reduction in violence impacting the public.⁷ However, even under AMLO’s tenure from late 2018 to 2024, there were instances of mass violence whenever a key cartel member was targeted by security forces—including random killings, mass instances of vandalism, and sophisticated attacks on security forces almost certainly designed to deter further actions. 

• Similar acts of violence followed the capture of Ovidio Guzmán López, the son of Sinaloa Cartel leader Joaquín “El Chapo” Guzmán, in the neighboring state of Sinaloa in 2019. The operation ended with AMLO reportedly ordering the release of El Chapo’s son to protect public security after security forces were overpowered by Sinaloa Cartel gunmen. A near-identical episode of street violence occurred when Ovidio Guzmán López was arrested again on January 5, 2023.⁸ 
• August 2022 saw a wave of cartel-related violence across Mexico, led by the large border cities of Tijuana and Ciudad Juarez. There, cartels instigated highly publicized acts of violence—like torching dozens of cars at once in Tijuana or large-scale street and prison battles in Ciudad Juarez—after the arrest of their key leaders.⁹

In the week preceding the violence in Ciudad Juarez and Tijuana in August 2022, there were other acts of cartel violence in the states of Jalisco and Guanajuato, which are bases for drug trafficking and oil smuggling (Huachicol)—Mexico’s two largest illicit economies in recent years.¹⁰ The attacks included street battles between well-armed cartel members and security forces and deliberate torching of cargo trucks and buses along roadways. In addition to vehicle fires, convenience stores and pharmacies were targeted. Following that, CJNG members imprisoned in Ciudad Juarez rioted, and the violence spilled into the streets. CJNG members, who are not the dominant cartel in Tijuana, then launched disruptive vehicle fires.¹¹

• Finally, in August 2024, there was widespread violence between factions of the Sinaloa Cartel in the sparsely populated western states of Culiacán and Sinaloa. The executions, roadblocks, and street clashes were almost certainly related to the July 2024 arrest of Sinaloa Cartel member Ismael Zambada by U.S. law enforcement.¹² Zambada took control of the Sinaloa cartel after the arrest of El Chapo; however, El Chapo’s sons reportedly orchestrated Zambada’s arrest, believing he had played a role in their father’s arrest.

Threats to Westerners and U.S. Political Pressure

The deliberate targeting of Puerto Vallarta and Guadalajara in the aftermath of El Mencho’s death has prompted concern for the security of tourists. Puerto Vallarta is approximately two hours from the special operations site and seems to have been targeted solely for “shock value,” which raises concern for other similar tourist hubs such as Acapulco, Cancún, and Cabo—especially if a counter-narcotics operation were to take place nearby. Notably, Guadalajara will be hosting World Cup 2026 matches starting in June 2026.

• Historically, Jalisco has been the base for a number of drug cartels, including CJNG. Its capital, Guadalajara, is arguably Mexico’s second most important city given its large population, making it a key transport hub and financial and tourism center. Many cartel leaders come from smaller nearby states such as Sinaloa and Colima that lack a large central city, making Guadalajara a critical logistics and meeting point.
• Adding to the risk, the Trump administration has pushed for Mexico to take a tougher stance on organized crime. There is a roughly even chance that highly publicized U.S. pressure against Mexican officials will lead cartels to directly target American interests.

However, Mexican residents are the primary victims of cartel-related crime, and deliberate targeting of Westerners is rare. Despite efforts to avoid targeting Westerners, shootings have injured or killed innocent bystanders, and U.S. citizens have been victims of kidnappings. When it does occur, it usually prompts a U.S. Embassy travel warning that is harmful to tourism,¹³ which would likely lead to a security crackdown. Any deliberate targeting of American interests by the cartels will increase the likelihood of a U.S. military response inside Mexico against them.

Conclusion

Multiple Mexican presidents have pursued a tougher-on-crime approach, including AMLO at the beginning of his tenure. These efforts have all been unsuccessful, as they require rooting out corrupt officials while maintaining morale as violence escalates; meanwhile, foreign investment either departs or holds off as the security situation deteriorates.

• The potential positives of rooting out corruption and regaining control of institutions from criminal groups have never materialized. 
• AMLO’s approach likely avoided the large economic impact that a major security crackdown would bring. Under an expanded anti-cartel operation, Mexico would very likely need to expend resources to combat the well-armed cartels, who would likely increase their violence in response.
  • The Mexican peso currency and a broad range of Mexican stocks declined following the special forces operations against El Mencho,¹⁴ which is likely a reflection of concerns that anti-cartel operations will have negative economic impacts.
• Over the long-run, AMLO’s wait-and-see approach likely strengthened the cartels, and it will very likely eventually become politically impossible for his chosen successor, Claudia Sheinbaum, not to launch a military response.

Sheinbaum assumed office in 2025 and had largely continued AMLO’s policies pertaining to the cartels until now. It is unclear if the killing of El Mencho represents a turning point in her security posture. If Sheinbaum continues targeting more cartel leaders, or if she grants permission for U.S. operations targeting cartels, a violent cartel response that elevates the risk of violence nationwide is almost certain. Whether Sheinbaum is willing to take this risk so close to the beginning of the World Cup is unclear, but she is very likely facing continued pressure from the United States—including over extending the U.S.-Mexico-Canada (USMCA) free trade agreement around the same time.¹⁵ Therefore, over the long term, Sheinbaum has political incentives to harden her security posture; however, in the short term, she has likely reduced the pressure to allow unilateral U.S. operations inside Mexico.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 11:15 AM (EST) on February 24, 2026; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

ZeroFox Intelligence Probability Scale 

All ZeroFox intelligence products leverage probabilistic assessment language in analytic judgments. Qualitative statements used in these judgments refer to associated probability ranges, which state the likelihood of occurrence of an event or development. Ranges are used to avoid a false impression of accuracy. This scale is a standard that aligns with how readers should interpret such terms.

1. hXXps://www.reuters[.]com/world/americas/new-us-military-led-group-aided-mexicos-hunt-el-mencho-cartel-boss-2026-02-22/
2. hXXps://app.dataint[.]mx/es/public/map
3. hXXps://www.infobae[.]com/mexico/2023/05/04/el-mapa-del-narcotrafico-en-mexico-en-2023-que-carteles-dominan-el-territorio/
4. hXXps://en.mercopress[.]com/2026/02/24/mexico-deploys-thousands-of-troops-after-violence-flares-following-el-mencho-death
5. hXXps://x[.]com/GildoGarzaMx/status/2026000144294883508
6. hXXps://x[.]com/All_Source_News/status/2026075192544440592
7. hXXps://aristeguinoticias[.]com/2205/mexico/carteles-de-la-droga-han-prosperado-durante-gobierno-de-amlo-financial-times/
8. hXXps://www.aljazeera[.]com/news/2023/9/16/ovidio-guzman-son-of-feared-mexican-drug-lord-el-chapo-extradited-to-us
9. hXXps://www.bbc[.]com/news/world-latin-america-62537830
10. hXXps://www.globalguardian[.]com/newsroom/risk-map-mexico
11. hXXps://www.informador[.]mx/mexico/Guanajuato-Tambien-se-registran-bloqueos-e-incendios-en-Celaya-e-Irapuato-VIDEO-20220809-0164.html
12. hXXps://www.justice[.]gov/usao-edny/pr/ismael-el-mayo-zambada-garcia-co-founder-sinaloa-cartel-arraigned-brooklyn
13. hXXps://mx.usembassy[.]gov/security-alert-update-4-ongoing-security-operations-u-s-mission-mexico-february-23-2026/
14. hXXps://www.bloomberg[.]com/news/articles/2026-02-23/mexico-details-how-it-took-out-its-most-wanted-drug-cartel-chief
15. hXXps://www.csis[.]org/analysis/usmca-review-2026