On January 20, 2025, US President Donald Trump designated all Mexican cartels as foreign terrorist organizations. This move followed earlier proposals to combat cartel activities, including suggestions to intervene in Mexico, with the primary goal of stopping the spread of fentanyl into the United States. By labeling cartels as terrorist entities, platforms now face significant challenges in addressing content linked to these groups, especially under the heightened scrutiny of the Online Safety Act (OSA) and Digital Services Act (DSA).
However, as platforms face growing pressure to ensure compliance under the DSA, Mexican cartels continue to evolve their use of social platforms and encrypted messaging apps to bypass moderation and recruit new members online. In Mexico, criminal groups, including cartels and their supporters, actively use social media to glorify illegal activities, promote extreme violence, and spread propaganda to undermine rivals. Despite robust community guidelines against graphic violence, nuanced content shared by anonymous citizen journalists or “narco-bloggers” documenting cartel activities often includes educational elements, making moderation a complex task.
Despite the challenges of curbing Mexican cartel content, social media is fast becoming the dominant source of grassroots information on the latest episodes of violence in Mexico, particularly in regions heavily affected by ongoing territory conflicts over drug trafficking routes. Criminal groups have shown that they can evolve their tactics, techniques and procedures to evade content moderation and leverage the reach and audience of social platforms to engage in outreach and recruitment.
“100 Days of Terror”: Mexican Cartels Crisis Intensifies
Since 2018, cartel-related violence in Mexico has resulted in over 30,000 deaths per year. Mexican President Claudia Sheinbaum’s tenure has been described by Mexican media as “100 days of terror”, with over 500 people killed in cartel violence in Culiacan alone between September and December 2024.
There is rising sentiment amongst the Mexican population for government intervention amid increasing levels of violence. Communities strongly reject the notion of living under a “narco-state”, underscoring the widespread criminal influence in certain areas, with over a third of the state reportedly controlled by cartels.
Graph depicting murder rate between 2014 – 2021 enacted by cartel factions. (Scale 1=1000). Source: The World Bank
Mexican cartel-enacted violence in 2024-2025 is now being directed towards an increasing number of politicians, journalists and social media influencers, with every individual being considered a “legitimate target”. Criminal groups will likely continue to use mainstream platforms and encrypted messaging apps to turn local feuds into violent online confrontations.
How Mexican Cartels Weaponize Social Platforms
Mexican cartels have developed sophisticated digital strategies to exploit social platforms as a means of extending their influence beyond physical territories and amplifying cartel propaganda. Their approach has evolved from directly amplifying propaganda to a more nuanced system of content distribution aimed at circumventing enforcement by platform moderators. These tactics include:
How Mexican Cartels Use Narco Blogs for Cartel Propaganda
Mexican cartels have splintered into factions and multiplied over the last decade due to internal conflict and operations. This fragmentation is reflected online, with criminal groups relying heavily on the work of its members and supporters to boost its reach across online platforms.
Criminal groups have moved graphically violent posts from “official” accounts directly linked to them, to unofficial accounts run by members and supporters. The larger faction stays mostly anonymous. These networks focus on sharing content that glorifies cartel lifestyles, promotes the group and its activities, and showcases extreme graphic material across social media.
When a post or account gets taken down, they quickly create new accounts, preserving the group’s overall presence. This allows them to repeatedly bypass moderation, producing content that spreads through encrypted messaging platforms and gains traction using common hashtags or emojis to strengthen the group’s reach across platforms.
Despite efforts to curb graphic content being uploaded onto mainstream social media platforms, media coverage of Cartel-afflicted areas is now undertaken by “narco-blogs” or “narco-documentary” accounts. Critics have accused these blogs of serving as mouthpieces and amplifiers of cartel propaganda, arguing that graphically violent content delivered in this format only serves to showcase the lifestyles which criminal group members pursue, and the extreme violence they perpetuate.
In response, “narcobloggers” argue that graphic depictions of violence serve an educational purpose, offering an unfiltered glimpse into the harsh realities of criminal violence in Mexico. However, addressing the risks associated with such accounts proves challenging due to their extensive online presence, maintained through a web of affiliate accounts. The removal of narco-blog content is also complicated by debates surrounding its potential educational or artistic significance.
Encrypted Messaging & Moderation Evasion Tactics
Mexican Drug Trafficking Organizations rely heavily on end-to-end encrypted messaging applications, the anonymity and privacy offered by such platforms make them popular among such organizations. On some platforms, the use of such encryption also means that platforms are unaware of what content is being shared among groups, or whether such content violates their terms of service or community guidelines.
Another advantage conferred by the use of such encrypted platforms are that Cartel affiliated accounts are typically suspended if the recipients of these messages report them, and criminal groups aim to make reporting their presence difficult when contacting a user. Groups often threaten to inflict bodily harm and share extreme graphic content in an attempt to intimidate users away from alerting the platform or authorities.
In addition to standard users, journalists, security forces and narco-bloggers also face violent threats and threats of kidnapping from Mexican cartels through social media platforms. In 2014, a contributor to a narco-blog was tortured and murdered, with the group responsible gaining access to their social media accounts to warn others documenting cartel activities.
Mexican cartel factions also exploit social media platforms by offering rewards for information on anonymous accounts reporting on them. In late 2024 and into 2025, Sinaloa-based social media influencers have been targeted and executed by Mexican cartels operating in the region due to their large followings over multiple platforms to maintain control over territory. There are indications of social media influencers allegedly being affiliated with certain cartel factions, which leads to a potential space for Mexican cartel groups to exploit, reaching out to younger audiences and gaining support.
An illustrative example of this behaviour is provided by a group of social media influencers in Mexico acting under the title ‘Los Toys’, headed by Marcos Eduardo Castro Cárdenas, ‘Markitos Toyz ‘; who in turn is accused of his alleged ties to Los Chapitos faction of the Sinaloa Cartel and the production of fentanyl.
How Mexican Cartels Recruit on Social Media
Beyond direct intimidation and violence, Mexican cartels employ sophisticated propaganda techniques to reshape their public image and attract new members. This strategic communication represents a critical dimension of their broader influence across social platforms.
Narcodepensa: Posing as Self-Defense Groups
Aside from intimidatory threats and the amplification of violence, Mexican cartels also use social media to win public approval and attract recruits. Smaller cartel factions often claim to be protecting Mexican citizens from larger, more dangerous outfits such as factions of the Sinaloa Cartel or Cártel de Jalisco Nueva Generación (CJNG), labelling themselves as “self-defence” groups operating in regions of Mexico.
Criminal syndicates also use social media to circulate information that paints them as protectors, a tactic which is utilized throughout Latin America. Videos of criminal groups distributing aid to citizens in the wake of COVID-19 pandemic and natural disasters are now common and known as “narcodepensa”.
Small cartel faction posting to social media platform indicating they act as a self-defense group in Tabasco, Mexico
Examples include CJNG members distributing food and supplies in cities and rural areas of Mexico, labeling aid boxes with the group’s name and prints of the leader’s face, posting them online with the intention of influencing communities at a time of strain on official attention and resources.
Narcodepensa being distributed featuring a print of Nemesio Rubén Oseguera Cervantes “El Mencho”, leader of Jalisco Cartel Nueva Generacion (CJNG)
Many platforms have not included criminal organizations within existing policies designed to counter more traditionally defined online terrorist activity, which is typically linked to proscribed terrorist organisations and individuals. Other policies can be used to counter the risk, however, if the content does not explicitly encourage violence or include graphic material, it becomes difficult to determine whether it violates existing guidelines. Additionally, content relating to cartel activity is also likely to be considered newsworthy, and content that promotes a group can be circulated through mainstream media or narco-blogs.
Narcocultura: Glamorizing Cartel Lifestyle
The Mexican cartels maintain a notable presence online through the promotion of “narcocultura” [ES Trans: narco-culture]. This derives through narcocorridos, songs that praise the exploits of criminal leaders. Such songs are frequently shared by group members or supporters on social media platforms.
More recently, a popular trend that has migrated across social media platforms depicts a romanticized vision of cartel lifestyle. Further complicating matters for platforms, the genre of “narcocultura” exists as a popular art form independent from cartel propaganda. Similarly, artists from other musical sub-cultures in the country also adopt criminal style clothing or symbols, without any affiliation to Mexican cartel factions.
Mexican cartels are known to recruit via social media platforms, either through forced recruitment using deception or through voluntary recruitment. On social media platforms, cartels offer job opportunities in “local groups” with housing, food, weapons training, leading vulnerable individuals to encrypted messaging applications for further details.
Cartel recruitment advertisement on a mainstream social media platform.
Advertisements are often explicit with indications of working in organized crime for high salaries. Mexican cartels often aim to target and exploit young social media users from poor backgrounds integrating them into ranks. Under this pretext, the authorities have maintained that the young people leave of their own free will, without taking into account that they are victims of crime.
As part of this trend, seemingly legitimate job offers are advertised by Mexican cartels on social media platforms, such as listings for security guards, flyer distributors, and bodyguards. Drug Trafficking Organizations recruit potential victims who are then held against their will, losing contact with families and disappearing. Close cooperation with organisations that are well versed in local dynamics is essential to improving content moderation.
Platform Compliance Challenges Under DSA & OSA
Mexican cartel groups often operate through decentralized account networks, rather than well-established accounts operated by a centralized media body. These supporter accounts use hashtags and emojis to share content that promotes illicit cartel activities- which can be challenging for platforms to identify and moderate. The use of music can also be a challenging obstacle to overcome, especially since most social media platforms have specific caveats in their community guidelines around moderating content with educational or artistic value. Due to the complex intersections between glorification of violence and music, policies are put to the test by cartel content online.
Following President Trump’s designation of Mexican cartels as foreign terrorist organizations, it is highly likely that platforms will face increased scrutiny at a time when cartels are likely to retaliate with violence while continuing to exploit social media for recruitment purposes. This complex dilemma requires continuous understanding of the risk area and how evasion techniques can be used by bad actors to remain on the platform.
Resolver in-depth and holistic Trust and Safety Intelligence service helps platforms monitor and mitigate against the misuse of their platform or service by Mexican cartel and cartel-affiliated accounts. Our human-in-the-loop methodology blends automated detection with threat actor intelligence drawn from a team of experienced human analysts with native speaking expertise across 50+ languages including Spanish to ensure our partners are always the first to know, and first to act. Our fully-managed service can support Trust and Safety teams stay compliant with the DSA, OSA and other regulatory frameworks enforced in 2025.
