An Encrypted Chat, A Hard Drive And Dozens Of Arrests: How Mexico Unraveled The CJNG Network Behind Carlos Manzo’s Murder

Although they all usually wrote in lowercase, that afternoon “El Licenciado” sent a message in capital letters to the group chat, leaving no doubt about the importance of the target: Carlos Manzo had to die right there and then.

It was 7:50 p.m. on November 1, 2025. Six or seven minutes remained before one of the young men would fire his 9mm pistol at the victim. The mayor of Uruapan, one of Mexico’s richest agricultural regions, was walking through the town square, which was packed with people. It was Day of the Dead. Journalists were livestreaming the opening of the Candle Festival on social media. Manzo was carrying his son in his arms. That was when El Licenciado wrote: “I REPEAT, IT DOESN’T MATTER IF HE HAS THE KID WITH HIM, DO IT ANYWAY.”

And they did. The killer, a 17-year-old methamphetamine addict, shot Manzo in the square minutes later. By then, the child was no longer in his father’s arms. The mayor died shortly afterward on the way to the hospital. It did not take long for the entire country to learn of the attack. Videos of the shooting magnified the horror, reaching cellphones in every corner of Mexico.

The assassination of Carlos Manzo marked the beginning of a new chapter in Mexico. Mexican President Claudia Sheinbaum had made the fight against crime one of the pillars of her administration. The criminal wars in Sinaloa had emerged as its first major challenge and showed no sign of easing. Then came the attack on Manzo, a controversial but popular figure who frequently appeared on social media patrolling alongside police officers, arresting criminals, and parading them before the public.

The attack became the government’s foremost challenge. The mayor was cast as the victim of an entire country, of the violence and power wielded by organized crime. A thorough investigation, mapping the conspiracy and arresting everyone involved, regardless of who might be implicated, seemed the only way out of the crisis.

A year later, the progress is unmistakable, something unusual in a country plagued by staggering levels of impunity. Based on previously unpublished information, EL PAÍS has reconstructed the authorities’ investigation, carried out in part by officials in Michoacán and in part by the federal Security Ministry.

To date, 34 suspects have been arrested and at least five others remain in investigators’ sights, one of them of particular importance, according to information obtained by this newspaper. The alleged mastermind, Ramón Álvarez Ayala, known as “R1,” was arrested in July; his right-hand man in the operation, El Licenciado, had been captured months earlier.

The investigation began with footage from 14 videos recorded at the scene, some obtained from social media and others from security cameras in the town square. The videos showed the three members of the team tasked with carrying out the attack: 17-year-old Víctor Ubaldo, 16-year-old Fernando Josué, and a man named Ramiro.

All three are dead. Víctor Ubaldo, the gunman, was killed by gunfire from one of Manzo’s bodyguards shortly after the attack. Although rumors initially circulated that the bodyguards, all of whom are in prison except for their fugitive chief, had killed Víctor Ubaldo as part of the conspiracy, investigators have found no evidence to support that theory. The other two were found murdered nine days later, on November 10, on a highway outside Uruapan. Investigators quickly identified them because they were wearing clothes from a store they had visited hours before carrying out the shooting.

Over the course of the investigation, two pieces of evidence proved crucial for authorities: a cellphone and a hard drive.

The cellphone belonged to Ramiro, known as “El Jaguar.” When authorities examined it, they discovered a group chat on the Threema messaging app called “Ciudad” (City). The group had nine members.

“El Licenciado created it a day or two before the attack. They used it for surveillance and to prepare the attack,” said a source familiar with the investigation.

The other participants, including Ramiro himself, were members of the Jalisco New Generation Cartel (CJNG) structure operating in Uruapan and surrounding areas, which was led by El Licenciado. According to an organizational chart included in the investigation and reviewed by this newspaper, the group’s main local structure comprised more than 140 members at the time of the attack.

The avatar

In the Ciudad group chat, the most active participant was someone who used a particularly distinctive avatar: a man dressed in a black suit and tie over a white shirt, wearing a cap, balaclava, tactical vest, magazine pouches, a ring, silver necklaces and bracelets, seated on what looked like a throne.

His messages appeared under the name “Lic,” short for Licenciado. Perhaps aware of what might happen after the attack, Ramiro had left a letter at home addressed to his wife. In it, he explained who Lic was, what his alleged role in the attack had been, his real name, Jorge Armando Gómez, his cellphone number and the ID he used on Threema. He told his wife that it was not true that he had been working in avocado orchards. He apologized for the lie and added that, if anything happened to him, it would be because of his role in the Carlos Manzo case.

By mid-November, the investigation was beginning to take shape. An anonymous tip reportedly received by prosecutors in Michoacán helped narrow the search for El Licenciado, already a focus because of Ramiro’s letter and cellphone. The caller said that El Licenciado was also known as “El Conta” and drove a white Suzuki Jimny. The tipster even provided the vehicle’s license plate number. A lightbulb went on for investigators.

“We had identified a Conta linked to the CJNG around Lake Cuitzeo,” one of the investigators explained. “We tracked him for extortion of municipalities and companies in that area and for some homicides over the previous six months.”

Investigators also knew Conta’s avatar: a man in a black suit seated on a throne. When they compared the two profiles, they realized they were looking at the same person.

Using the cellphone number provided by Ramiro and information about his vehicle, investigators quickly tracked him down. By November 17, they had him under surveillance at his home in downtown Morelia. The following day, while monitoring the residence, they saw him leave and moved in to arrest him.

Hours later, during a search of the house, investigators discovered a two-terabyte Toshiba hard drive. Inside was “all the information on his organization’s structure, in the hills and the city of Uruapan — the groups in the hills focused on fighting rivals and those in Uruapan centered on kidnappings, extortion, homicides and running small casinos,” the source continued. “There was a lot of information on the group, payrolls, the products they handled: marijuana (which they called ‘cafe’), methamphetamine (‘frio’), cocaine (‘suave’), heroin/crack (‘duro’), vapes, cigarettes, slot machines… everything.”

The hard drive also contained a document prepared by the Michoacán Attorney General’s Office in 2021 detailing the CJNG’s overall structure, then headed by Nemesio Oseguera Cervantes, alias “El Mencho,” who was killed in a military operation in February of this year.

How that document ended up in the hands of a cartel leader was a question investigators could not answer. But its presence on the hard drive pointed to collaboration between security forces and the CJNG, a connection that would resurface months later as investigators surveilled another branch of the organization, also linked to the Manzo case.

By the third week of November, the problem was no longer a lack of information but how to manage its sheer volume. The messages exchanged in the Ciudad chat group themselves outlined the main structure of the conspiracy.

With El Licenciado under arrest, investigators knew that at least one higher-ranking member of the CJNG had been aware of the plot and had pushed it forward. On November 1, the day of the attack, at 6:56 p.m., El Licenciado wrote that Manzo and his entourage were running late because “they’re out distributing candles,” part of the town’s Day of the Dead traditions.

The leader of the conspiracy added: “They’ll tell us when he comes out. Anyway, we should already be ready to tear him up like the boss wants.” No one in the group seemed to have any doubt about whom El Licenciado meant by “the boss.”

Investigators soon identified that boss as Ramón Álvarez Ayala, known as “R1,” one of the CJNG’s most powerful figures, a close associate of El Mencho and a dominant force in his home state of Michoacán. Authorities had arrested him in Guadalajara in 2012, and even then he was described as “the second most important figure in the criminal organization’s structure.”

Both R1 and his brother, Rafael Álvarez Ayala, known as “R2,” received orders directly from El Mencho and oversaw the cartel’s operations in the Tierra Caliente region south of Uruapan. Their influence became evident in late 2022, when R1 was released by a judge despite facing charges of organized crime and kidnapping.

In the Manzo investigation, testimony from protected witnesses indicated that El Licenciado reported directly to R1.

The municipal council’s group chat

There were still many unanswered questions. The vertical outline of the criminal hierarchy left much of the plot unexplained. Three deaths marked the starting point: the gunman, his friend and backup shooter, both minors, and the recruiter and coordinator, Ramiro. There was a boss, El Licenciado, and by mid-November investigators already knew of his connection to R1. But much remained unclear.

Besides Ramiro and El Licenciado, who were the other seven members of the Ciudad group? The two minors were not in the chat. How had they become involved in the plot? How had Ramiro met them? Who had killed Ramiro and Fernando Josué, the backup shooter? And beyond that, what helping hand or hands had the criminal conspiracy found within Mayor Manzo’s inner circle?

Messages exchanged in the Ciudad group by El Licenciado and another participant using the alias “Brilloso” quickly led investigators to suspect that people close to Manzo were leaking information to the criminal organization.

At 6:50 p.m. on November 1, for example, El Licenciado wrote: “Right now they’re at the Casa de Cultura. That’s what I’m being told. The target is inside.”

A minute later, he added: “He’s going to the candle-lighting ceremony at 7. That’s what I’m being told.”

Three minutes after that, he continued: “At 7 he’ll leave the Casa de Cultura for the Pergola, and from there he’ll go on the procession and then to see the [Day of the Dead] altars. They say they’re running late.”

Then, at 7:07 p.m., El Licenciado sent a photograph showing someone holding a cellphone. On its screen were messages from the Uruapan municipal council’s group chat.

This was extremely serious, and it also provided a crucial lead. It was not merely that CJNG lookouts had been tracking Manzo throughout the main night of the Day of the Dead celebrations. Someone with access to the chat in which the mayor communicated with council members and other municipal officials was forwarding screenshots of those conversations to the criminal group.

In the photograph in question, a message from Manzo himself could be seen in the council chat. El Licenciado transcribed it for the group: “The mayor is telling his people that for the candle-lighting ceremony we should gather in the square by La Inmaculada, please.”

Several participants in the chat replied with messages such as “copied” and “understood.” At that point, all that remained was to wait for the two shooters, coordinated by Ramiro, to move in on their target.

By mapping Ramiro’s communications using the two cellphones seized from his wife, investigators began to reconstruct his network of criminal contacts. In his contacts list, they found a number saved under the alias “Viejito.” Over time, they discovered that Viejito was a Uruapan taxi driver who sold drugs for the CJNG and coordinated with a man known as “La Pava.”

Investigators also learned that one of Viejito’s customers was a man named Samuel. Once again, a lightbulb went on. Almost from the beginning, investigators had suspected Samuel García, the city government’s director of public relations.

“We knew he had had conflicts with the mayor,” said a source close to the inquiries. “Also, because he used [cocaine], he exhibited somewhat suspicious behavior and on the day of the event [November 1], he didn’t go to the square.”

Investigators believe that the screenshot showing Manzo’s message was sent by Samuel García to Viejito. Viejito then allegedly forwarded it to La Pava, whose name had appeared in the Ciudad Threema group. La Pava would in turn have passed it on to his boss — whose arrest remains pending and is perhaps the investigators’ top priority — and that person then forwarded it to El Licenciado.

In January of this year, authorities announced the arrests of Viejito and Samuel García. La Pava would be captured later. Viejito admitted that La Pava had shared plans to attack Manzo with him and that he was the one who put him in touch with Samuel. Recruiting the city government’s public relations director was not difficult. He agreed to help them in exchange for “two bags of cocaine.”

La Basilia, El Caos

By January, several other arrests had already been made. Using the location data from a third cellphone carried by Ramiro, investigators quickly learned that the 34-year-old, who was also linked to the weapon used to kill Manzo and had allegedly used it himself in two murders in mid-October, had gone on November 9 to an area known as La Basilia, on the outskirts of Uruapan.

“We knew that place because it was where Ramiro had taken the young men for shooting practice,” explained the source, referring to the two minors, Víctor Ubaldo and Fernando Josué. “Ramiro took them there with a trainer of Colombian origin.”

On the day of the attack, Fernando Josué fled to La Basilia. Eight days later, Ramiro joined him there. The next day, both were found dead on a road not far from that site.

“Maybe they killed them because [Ramiro’s CJNG faction] knew we were on their trail. We had carried out investigative operations in La Basilia and Quirindavara,” the source added, referring to the Uruapan neighborhood where Ramiro hid right after the attack on November 1.

Data from Ramiro’s phones and witness statements quickly pointed investigators toward a local underworld figure, Alejandro Baruc Castellanos, known as “Comandante Caos.”

Investigators later determined that El Caos was El Licenciado’s trusted lieutenant in La Basilia and Tiamba, another settlement north of Uruapan. He was one of seven commanders reporting to El Licenciado in the region. Of those seven, only one remains free, or alive.

According to the organizational chart investigators compiled on El Licenciado’s network, El Caos had at least 16 people under his command.

Authorities arrested El Caos in November 2025 and charged him with the murders of Fernando Josué and Ramiro. In February, they detained three people linked to his group. One of them was Salvador Belmontes Aguilar, alias “Comandante 26,″ another of El Licenciado’s seven commanders.

“We also detained 26’s sister, who turned out to be Caos’s partner,” the sources added. After their arrests, both El Caos and Comandante 26 pointed to what they claimed was the motive behind the attack: the arrest, months earlier, of Comandante 26’s brother.

In August 2025, Manzo and his police force arrested another of El Licenciado’s seven commanders, René Belmontes, known as “Comandante Rhino.” According to investigators, it was not so much the arrest itself as the way Manzo handled it that mattered.

In a video recorded that day, Rhino appeared in the bed of a police pickup truck, handcuffed and with his face covered by his T-shirt. Beside him sat one of his associates, also handcuffed and similarly hooded. Standing below the vehicle, Manzo filmed them while saying: “So you’re doing shit around here, bastards? […] I don’t care what group you’re from, I just don’t want you pulling that crap around here, so it’s clear, okay? Did you hear me?” Both answered yes.

Brilloso and Vikingo

By mid‑2026, the case was moving at full speed. In addition to dismantling El Caos’s group and uncovering the message chain involving Samuel García and El Licenciado, authorities had arrested the taxi driver who transported Fernando Josué to La Basilia on the day of the attack, the middleman who arranged the ride, and Jaciel N, the link between Ramiro and the two teenage shooters.

While in rehabilitation centers in Uruapan, Jaciel had recruited Víctor Ubaldo and Fernando Josué and then put them in contact with Ramiro. Another of El Licenciado’s commanders had also been captured: Gerardo Rodríguez, alias “Kongo.” His arrest in March opened a new window into a part of the conspiracy that investigators had effectively put on the back burner since El Licenciado’s capture.

The hard drive seized from El Licenciado had contained evidence suggesting that the organization was receiving information from local authorities, but investigators had so far been unable to determine the full extent of those ties.

With Kongo’s arrest, investigators were finally able to do just that. Kongo had been on law enforcement’s radar since the earliest days of the investigation. His alias, “Kingkong,” appeared among the members of the Ciudad Threema group that El Licenciado had created to coordinate the assassination of Manzo, although he left the chat shortly after the attack.

When officers examined the cellphone seized during his arrest, they discovered another Threema group in which Kongo communicated with a lawyer named Wendy. Wendy was supplying Kongo with information about the Manzo investigation, information that could only have come from internal databases used by Michoacán authorities. Once investigators identified her, Wendy was arrested in mid-May. Shortly afterward, authorities detained the sources of her information: two men, one an active officer with Michoacán’s Forest Guard and the other a former investigator with the state Attorney General’s Office.

Authorities then turned their attention to the remaining members of the Ciudad group. Threema users log in with an alias and an associated account number. Investigators did not have access to the members’ phone numbers, making them difficult to trace. They had already identified Ramiro, who appeared under two different aliases, as well as El Licenciado and Kongo. Of the remaining participants, the one who interested them most was a user operating under the alias “Brilloso.”

On the night of the attack, shortly after the shooting, at 8:03 p.m., Brilloso wrote in the chat: “They say he’s in critical condition headed to the hospital.” That message led investigators to suspect that Brilloso, too, had access to information coming from people close to Manzo. Then, at 9:02 p.m., as reports of the mayor’s death began to emerge, El Licenciado and Brilloso congratulated the group.

“You guys really came through. My respect,” wrote El Licenciado.

“You really pulled it off,” Brilloso replied.

That exchange reinforced investigators’ belief that Brilloso occupied an important position within the conspiracy.

For months, they made little progress. Then, in late July 2026, they got a break.

“It turns out that on July 26 there was a report of armed people in a Uruapan bar,” said a source close to the investigation. “Apparently Brilloso and [his brother] Vikingo fought with others and boasted that they were plaza [local] bosses and the like. The state police arrived, interviewed the owner, and he said these two had gotten cocky and mentioned they were Brilloso and Vikingo.”

When investigators learned of the report, they connected the dots. They reviewed security footage, looked into the men’s identities, and discovered that Brilloso was actually Alexis Medina, a cousin of one of Manzo’s detained bodyguards, known as “Macas,” and a nephew of the municipality’s welfare secretary, Rosa Alejandra Vargas.

In those days, the investigation moved quickly. At the end of the month, R1 was arrested in Jalisco, and on August 7 authorities captured Alexis and his brother Cristian, known as “El Vikingo.”

“Brilloso and Vikingo reported directly to R1,” said the sources. “Apparently R1 had met Vikingo through boxing, because Vikingo made a name for himself in Jalisco as a fighter. At some point, R1 approached Vikingo and Vikingo introduced him to Brilloso,” they added. “What’s clear is that Brilloso participated in the Ciudad group; perhaps he obtained information from his cousin Macas and his aunt, because communication between Brilloso and both of them has been confirmed.”

On October 29, authorities arrested Brilloso’s aunt, Welfare Secretary Rosa Alejandra Vargas, on charges of obstruction of justice, after she spent a year refusing to appear for questioning by prosecutors.

The alleged involvement of Brilloso, his family and their links to the Manzo case sent shockwaves through Uruapan and deeply affected Manzo’s widow, Grecia Quiroz, who succeeded him as mayor.

“It turns out that Manzo is close friends with Brilloso and Vikingo’s mom, because he’s the godfather of her daughter — that is, the sister of those two,” the same sources said. “We have conversations showing that Brilloso wanted to rise within the criminal organization, and we concluded that this was his way of doing it. We are trying to determine whether Brilloso was being fed information. After all, his cousin was a bodyguard and his aunt a secretary.”

A few weeks ago, the Michoacán Attorney General’s Office reported that the case was 90% solved. The remaining 10%, a figure that would now be slightly lower following the arrest of Vargas, concerns the remaining members of the Ciudad Threema group.

Of the six suspects still unaccounted for, one may in fact be a man arrested months ago on allegations of fuel theft and other crimes while working under El Licenciado. Of the remaining five, three have already been identified and their arrests appear to be only a matter of time. Investigators have no information on another. The last is the link between La Pava and El Licenciado, whose capture also appears to be imminent.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition