After El Mencho: CJNG Retaliation Spreads Across Mexico
The killing of the world's most wanted drug lord has triggered coordinated violence in 20 states, shutting down tourism corridors, disrupting supply chains, and raising succession questions that could reshape Mexico's security environment for years.
Risk Matrix
Executive Summary
On February 22, the Mexican military killed Nemesio "El Mencho" Oseguera Cervantes, the founder and leader of the Jalisco New Generation Cartel (CJNG), triggering the most widespread coordinated cartel retaliation in modern Mexican history. Within hours of his death during a military operation in Tapalpa, Jalisco, CJNG operatives erected 252 roadblocks across 20 states, killed 25 National Guard members in six separate ambushes, deployed explosive-laden drones and vehicle-borne improvised explosive devices against military positions, and forced the cancellation of 237 commercial flights. The speed and geographic reach of the response, covering more than 60% of Mexico's territory, indicates pre-planned contingency protocols, not spontaneous violence.
The retaliation struck directly at Mexico's economic infrastructure, shutting down tourism corridors, severing freight routes, and temporarily suspending the country's largest container port. Puerto Vallarta, Guadalajara, and cities across Quintana Roo received shelter-in-place orders from the U.S. Embassy. At least seven countries issued travel advisories. Port of Manzanillo, which handles 66% of Mexico's total import cargo by tonnage, temporarily suspended operations before resuming under naval escort. OXXO convenience stores were systematically targeted across multiple states, with 69 damaged in Guanajuato alone. The Manzanillo-to-Guadalajara freight corridor, a critical link for automotive and electronics supply chains feeding U.S. manufacturing, was effectively severed.
The immediate violence, while severe, is not the primary risk. The real threat is what comes next: a succession struggle within Mexico's most powerful criminal organization, operating in a country that has never seen a major cartel decapitation produce lasting stability. The academic research points in one direction. A 2015 study in the Journal of Conflict Resolution found that eliminating cartel leaders reduces the cost for rivals to fight turf wars. A Cambridge study found that, on average, when a cartel leader is removed, one additional criminal group begins operating in that territory. Every major Mexican decapitation since 2003, from the Gulf Cartel to the Sinaloa Cartel, has produced fragmentation and escalated violence. The historical pattern is consistent, though not inevitable. CJNG may consolidate under a single successor, but the conditions that have preceded fragmentation in every other case are present.
The Signal
The operational signal from this event is severe across multiple dimensions. This is not a narrative surge driven by media amplification of isolated incidents. The data reflects coordinated military-grade action spanning the majority of Mexico's national territory.
Critical distinction: The retaliation reached 20 states within hours, demonstrating pre-planned contingency protocols and standing orders. This reflects organizational command-and-control capability, not spontaneous mob violence.
Operational Signal (High)
- -252 narcobloqueos across 20+ states within hours
- -25 National Guard killed in 6 coordinated ambushes
- -IEDs, explosive drones, VBIEDs deployed against military
- -Port of Manzanillo operations suspended
- -237 flights cancelled across 4 airports
- -10,000 troops deployed nationwide
- -23 inmates freed in Jalisco jail attack
Narrative Heat (High)
- -Global 24/7 media coverage; CNN live blog
- -At least 7 countries issued travel advisories
- -"Failed state" rhetoric on social media (overstated)
- -"Cartel is finished" counter-narrative from officials (also overstated)
- -Reports of "hostage situations" at airports (largely panic, not hostage-taking)
What Happened
On February 20, Mexican military intelligence received a tip about El Mencho's location after tracking a "trusted associate" of one of his romantic partners to a cabin complex in Tapalpa, a mountain town roughly two hours southwest of Guadalajara. The Mexican Air Force positioned six helicopters and the National Guard's Special Immediate Reaction Force established a ground cordon. U.S. intelligence provided what Defense Secretary Gen. Ricardo Trevilla described as "very important additional information" confirming the exact location. A former U.S. official told Reuters the Mexican government received a "detailed target package."
On February 22, Mexican special forces launched the raid. El Mencho and two bodyguards fled into a wooded area, where they were located and engaged. All three were seriously wounded and taken into custody, but died during helicopter transport to Mexico City. Troops seized armored vehicles, rocket launchers, anti-aircraft weapons, drones, and a large cache of high-powered firearms. Two additional CJNG members were arrested. Three Mexican soldiers were wounded.
The retaliation was coordinated by Hugo "El Tuli," El Mencho's right-hand man and top financial operator. According to the Mexican defense ministry, El Tuli offered a bounty of 20,000 pesos (approximately $1,100) per soldier killed. El Tuli was subsequently killed in a follow-up military operation in El Grullo, Jalisco, while attempting to flee. Reports also suggest that El Sapo (Gonzalo Mendoza Gaytan), a top CJNG logistics coordinator for precursor chemicals, may have been killed during the operation, though this remains unconfirmed.
Key Actors
Geographic Spread of CJNG Retaliation
Sources: Mexican SSPC, Global Guardian, Ackerman Group, Riskline, February 2026
What's Being Overstated
Separating signal from noise:
- - "The cartel is finished." U.S. and Mexican officials have framed the killing as a decisive victory. Deputy Secretary of State Landau called it "a great development." But CJNG's organizational infrastructure, drug routes, laboratory networks, and franchise agreements with local groups remain intact. As Dyami Security Intelligence analyst Chris Dalby noted: "El Mencho's removal is like saying a company is going to fail because you take out the CEO. Not at all."
- - "Mexico is a failed state." Social media narratives have amplified the violence into a nationwide collapse narrative. The reality is that the worst violence was concentrated in Jalisco, Guanajuato, and Michoacan. Mexico City, the financial and political center, was largely unaffected. The roadblocks in distant states were often isolated incidents, not sustained combat.
- - "Tourists taken hostage." Reports of hostage situations at airports were overstated. Travelers were stranded by cancelled flights and panicked by gunfire near airport perimeters, but there is no confirmed evidence of deliberate targeting of foreign tourists. That said, the duty-of-care implications for companies with personnel in Mexico are real and immediate.
- - "This proves the kingpin strategy works." The White House framed the operation as proof of effective counternarcotics policy. The academic record suggests otherwise. Every major cartel decapitation in Mexico since 2003 has been followed by fragmentation and increased violence. The only variable is timing.
Why It Matters
The Succession Vacuum
CJNG operates as a hierarchical franchise system, distinct from the Sinaloa Cartel's horizontal confederation. El Mencho served as the final arbiter, the architect of routes, the guarantor of alliances, and the ultimate authority on violence. His son "El Menchito" is serving a life sentence in the U.S. His wife, Rosalinda "La Jefa" Gonzalez Valencia, was released from prison in February 2025 but is not an operational leader. The most likely successor is his stepson, Juan Carlos "El 03" Valencia Gonzalez, who commands CJNG's most tactical armed wing, Grupo Elite. But at least three other figures, El Doble R, El Jardinero, and potentially El Sapo (if alive), have the manpower and territorial control to contest succession.
Eduardo Guerrero of Lantia Intelligence put it directly: "Precisely because of the enormous size of this organization, the probability of fragmentation is very high."
The Decapitation Track Record
Mexico has run this experiment before. The results are consistent.
The Sinaloa case is the most relevant precedent. After El Chapo's arrest in 2014 and extradition in 2017, the cartel absorbed the leadership change for nearly a decade under El Mayo Zambada. But when El Mayo was arrested in the U.S. in July 2024 under disputed circumstances, the delayed fragmentation finally arrived: homicides in Sinaloa rose by more than 400% in the following year, per CNN analysis. CJNG's hierarchical structure makes it arguably more vulnerable to decapitation than Sinaloa's horizontal confederation.
A West Point study found that criminal groups in Mexico proliferated from 76 in 2009 to over 200 by 2020, driven largely by the kingpin strategy. A Cambridge study found that each leader removed produces, on average, one additional criminal group in that territory. Vanda Felbab-Brown of Brookings described the strategy as "highly counter-productive."
The Nearshoring Collision
The affected states are not peripheral. Jalisco and Guanajuato sit at the center of Mexico's manufacturing renaissance. Jalisco, often called "Mexico's Silicon Valley," hosts Foxconn/Nvidia ($900M GB200 server assembly plant), Intel's design center, and ASE Group's IC packaging facility. Guanajuato's El Bajio corridor houses GM, Toyota, BMW, Nissan, and Honda across 570+ international manufacturing facilities. Mexico recorded $40.9 billion in FDI through September 2025, with new greenfield investment up 200% year-over-year. If sustained instability follows the historical pattern, the cartel fragmentation risk could challenge the nearshoring thesis in its most concentrated corridors. Some sectors may prove more resilient than others, but the uncertainty itself has costs.
The FTO Compliance Time Bomb
Since February 2025, CJNG has been designated a Foreign Terrorist Organization by the United States. This means any company whose supply chain touches cartel territory faces theoretical material support liability under U.S. anti-terrorism law. Extortion payments, "road taxes," and even ransom payments could constitute material support for terrorism. Major law firms including Skadden, DLA Piper, Hogan Lovells, and Foley & Lardner have all published advisories. If fragmentation produces more splinter groups demanding more extortion from more businesses, the compliance exposure for multinationals operating in western Mexico escalates significantly.
Sector Impact
| Sector | Immediate Impact | Medium-Term Risk |
|---|---|---|
| Tourism | 237 flights cancelled. Puerto Vallarta ($2.4B annual revenue) shut down. Shelter-in-place across Cancun corridor ($6-7B annual). Marriott and Hilton activated flexible cancellation. | Guadalajara hosts FIFA World Cup matches in June 2026. Insurance premiums will rise. Brand damage to Mexico's tourism positioning may persist. |
| Manufacturing / Nearshoring | Manzanillo-Guadalajara freight corridor severed. Port of Manzanillo (66% of Mexico's total import cargo) temporarily suspended operations. Just-in-time auto supply chains threatened. | Jalisco hosts major semiconductor and tech investments including Foxconn/Nvidia's $900M facility. Guanajuato's auto corridor (570+ international manufacturers) faces disruption risk. Fragmentation could increase extortion demands on manufacturers. |
| Real Estate | Foreign-owned properties in Puerto Vallarta, Guadalajara, and coastal Jalisco face immediate devaluation pressure. | If fragmentation produces sustained territorial conflict, property values in western Mexico could decline materially. Insurance costs will increase. |
| Agriculture | Michoacan avocado supply chain ($3.8B in Mexican exports, 2024) runs through cartel-controlled territory. Tequila production centered in Jalisco ($3.2B in exports, 2024). | Cartel fragmentation historically increases extortion on agricultural producers. Research estimates cartel extortion of the avocado trade at roughly $150M per year in key municipalities. |
| Energy / Infrastructure | Gas stations systematically attacked. Port of Manzanillo ($3B expansion underway) disrupted. Pipeline infrastructure exposed. | Manzanillo is the only Pacific port authorized for chemical precursor imports. Three cartels compete for control. Infrastructure investment risk elevated. |
Client Implications
PE/VC Firms
Exposure: Portfolio companies with manufacturing, logistics, or consumer operations in Jalisco, Guanajuato, Michoacan, or Colima face direct disruption. Nearshoring-thesis investments are stress-tested.
Opportunity: Security services, insurance, compliance consulting, and alternative nearshoring locations (Nuevo Leon, Queretaro if unaffected) may see demand spikes.
Risk: FTO designation creates material support liability for portfolio companies paying extortion or "road taxes." Fragmentation increases extortion frequency. Diligence on Mexican supply chain exposure now essential.
Family Offices
Exposure: Direct real estate holdings in Puerto Vallarta, Guadalajara, or coastal Jalisco face devaluation pressure. Tourism-linked investments (hotels, hospitality funds) at immediate risk.
Opportunity: Distressed asset acquisition if sustained violence depresses valuations in fundamentally sound markets. Selective reentry after stabilization.
Risk: Personal travel safety for principals with Mexican residences or vacation properties. Kidnap and ransom insurance review warranted. Peso volatility.
Corporates
Exposure: Supply chains routing through Manzanillo, Guadalajara, or Guanajuato face immediate disruption. Trucking insurance up 30% in cartel-affected areas. Logistics costs +8-12% with rerouting and enhanced security.
Opportunity: Companies with diversified sourcing will outperform single-corridor dependents. Security posture differentiation becomes a competitive advantage.
Risk: Duty-of-care obligations for employees in Mexico are legally binding. 87% of U.S. companies in Mexico increased security measures due to extortion, per U.S. Chamber survey. FTO compliance exposure requires legal review.
Law Firms
Exposure: Clients with Mexican operations need immediate FTO compliance review. Material support liability, Anti-Terrorism Act (ATA), and JASTA create novel exposure.
Opportunity: Sanctions, compliance, and cross-border advisory demand will increase. M&A due diligence for Mexican targets now requires cartel exposure mapping.
Risk: Rapidly evolving regulatory environment. State Department designations may expand. Client advisory obligations heightened during active crisis.
Due Diligence Questions
Questions to incorporate into active due diligence processes:
Supply Chain Exposure
- -What percentage of our supply chain routes through Jalisco, Guanajuato, Michoacan, or Colima? Do we have contingency routing?
- -Are any Tier 1 or Tier 2 suppliers dependent on Port of Manzanillo for inbound materials?
- -What is our just-in-time inventory buffer if the Manzanillo-Guadalajara corridor faces sustained disruption?
FTO Compliance
- -Have we assessed material support liability exposure under the FTO designation? Are any operations in cartel-controlled territories?
- -Are any vendors, logistics partners, or local contractors paying extortion, "road taxes," or protection fees to cartel-affiliated actors?
- -What is our K&R (kidnap and ransom) insurance coverage, and does it account for FTO designation constraints on ransom payments?
Personnel Security
- -Do we have employees, contractors, or executives currently in affected states? Have shelter-in-place protocols been communicated?
- -What is our duty-of-care framework for Mexico-based personnel? Is it documented and legally defensible?
- -Do we have evacuation plans for personnel in Jalisco, Guanajuato, and Michoacan? Have they been tested?
Investment Exposure
- -What is our total Mexico exposure across portfolio companies, real estate, and fund investments? Is it concentrated in affected states?
- -How do we model cartel fragmentation risk in our nearshoring investment thesis? Have we stress-tested for 12-24 months of elevated instability?
- -Are there contractual force majeure provisions that apply to cartel-related disruption in our Mexican partnerships or JVs?
Red Label Assessment
Primary Assessment
The immediate retaliation will subside within days to weeks as military deployments (10,000 troops) restore surface-level order. The real risk begins afterward: a succession struggle among at least three credible contenders (El 03, El Jardinero, El Doble R) with the capacity and motivation to contest leadership. If CJNG fragments along the lines of historical precedent, the result will be multiple competing organizations with less discipline, less restraint, and higher extortion rates across western Mexico. This is the pattern that has followed every major cartel decapitation in Mexico since 2003.
Alternative Interpretation
CJNG consolidates under El 03, who reportedly has the family connection and operational control (via Grupo Elite) to maintain organizational unity. Under this scenario, the immediate violence subsides within weeks, and CJNG continues as a coherent entity with modified leadership. The probability of this scenario is lower than fragmentation, but it is supported by the fact that some analysts report leadership has already transitioned to El 03. If the transition is clean, the investment and security outlook improves faster than the fragmentation scenario suggests.
Watch For
Intra-CJNG violence (factions fighting each other, not the military) within the next 30-90 days would signal fragmentation. Rival cartel incursions into former CJNG territory, particularly by Sinaloa Cartel factions, would confirm the worst-case scenario. Conversely, a rapid reduction in violence, consolidated messaging from CJNG leadership, and maintained alliance agreements with affiliated groups would signal successful succession under El 03.
Appendix: Deep Background
The Rise of CJNG
CJNG itself was a product of decapitation. When Mexican authorities dismantled the Milenio Cartel (also called the Cartel de los Valencia) around 2010, Nemesio Oseguera Cervantes, a mid-level figure, gathered remnants and formed what would become the Jalisco New Generation Cartel. The organization grew rapidly by using a franchise model, offering protection and logistics to local criminal groups in exchange for loyalty and tribute. By 2015, CJNG had become Mexico's fastest-growing criminal organization. By 2020, it operated in roughly two-thirds of Mexico's states.
The CJNG distinguished itself through military-grade capabilities that other cartels lacked. It was the first Mexican cartel to shoot down a military helicopter (2015). It pioneered the use of explosive drones and roadside IEDs, reportedly hiring Colombian mercenaries to train operatives along the Michoacan-Jalisco border. It acquired armored vehicles, anti-aircraft weapons, and tactical equipment more commonly associated with insurgent groups than drug trafficking organizations.
The Kingpin Strategy: 20 Years of Data
Mexico's kingpin strategy, pursued with U.S. support since the Calderon administration (2006-2012), has produced the following results, per West Point's Modern War Institute: criminal groups proliferated from 76 identified organizations in 2009 to over 200 by 2020. The International Crisis Group identified at least 543 armed groups operating in Mexico between 2009 and 2020. Annual homicides tripled from roughly 10,000 in 2006 to over 30,000 per year after 2017. The CATO Institute, citing Lindo and Padilla-Romo's research, found that capturing a cartel leader in a municipality increases its homicide rate by 60-80%.
Raul Zepeda Gil of King's College London's War Studies department offers a critical observation: El Mencho himself rose from the remnants of a cartel that was dismantled by the state. The kingpin strategy does not eliminate criminal capacity. It redistributes it.
The US Role
The Trump administration designated CJNG and five other Mexican cartels as Foreign Terrorist Organizations in February 2025. The $15 million reward for El Mencho, increased from $10 million in December 2024, was the highest for any Mexican drug trafficker. CIA Director John Ratcliffe reportedly expanded an anti-cartel intelligence program to include recruiting ground-level informants. The White House confirmed providing "intelligence support" to the operation. President Sheinbaum emphasized: "There is no participation of US forces in the operation. There is a great deal of information sharing."
The diplomatic dynamics are worth monitoring. The operation was framed as a joint success, but the underlying tension is real: U.S. pressure for aggressive cartel enforcement meets Mexican sovereignty concerns. If the post-decapitation violence escalates as historical precedent suggests, the narrative may shift from "effective cooperation" to "who bears responsibility for the consequences."
Sources
| Source | Data | Date |
|---|---|---|
| Al Jazeera | Operation details, retaliation timeline, expert analysis | Feb 2026 |
| CBS News | 25 National Guard killed, Garcia Harfuch confirmation | Feb 2026 |
| CNN | Operation narrative, girlfriend tracking, US intelligence role | Feb 2026 |
| Xinhua | 27 total security personnel killed, 46 criminal suspects | Feb 2026 |
| FreightWaves | Freight corridor disruption, Manzanillo suspension, trucking impact | Feb 2026 |
| Global Guardian | 250+ blockades, 22 states affected, CJNG weaponry (drones, VBIEDs) | Feb 2026 |
| InSight Crime | Succession analysis: El 03, El Doble R, El Jardinero, El Sapo | Feb 2026 |
| Small Wars Journal | Strategic analysis, El Tuli bounty, military assessment | Feb 2026 |
| Journal of Conflict Resolution | Calderon et al., cartel decapitation and violence dynamics | 2015 |
| West Point Modern War Institute | Kingpin strategy analysis: 76 groups (2009) to 200+ (2020) | 2023 |
| ACLED | Sinaloa cartel rift data, +400% homicides post-Mayo capture | 2025 |
| DEA | $15M reward increase for El Mencho (from $10M) | Dec 2024 |
| U.S. Embassy Mexico | Shelter-in-place orders, security alert for multiple states | Feb 2026 |
| EY | FTO compliance analysis: material support liability, insurance impact | 2025 |
| CNBC | 237 flights cancelled, airline-by-airline breakdown | Feb 2026 |
| The Conversation | Zepeda Gil (King's College): decapitation creates reorganization, not elimination | Feb 2026 |
| Brookings Institution | Felbab-Brown: kingpin strategy "highly counter-productive" | 2023 |