Threat Actor Characterization
HackPurgatory
ID: 43335327478c06d3680d12e05cfefd3c29474| HACK [PURGATORY] | 𝐇𝐀𝐂𝐊 [𝐏𝐔𝐑𝐆𝐀𝐓𝐎𝐑𝐘]™ | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
010a3816cc2d6934b44f5afceeb1399b65273 | Chronus Team | Mexico | ally-of | Hacktivist Group |
|
b6bae769224465c8aa770ec02df2716738985 | Team JXLL | Unknown | ally-of | Hacktivist Group |
|
|
60a42a17e4d63f77c742d2334589585742094 | Union Federal del Orden | Unknown | ally-of | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Hackpurgatory is assessed as a Spanish-speaking cybercrime-adjacent brand or community node that combines public-facing cybersecurity messaging with exposed search/lookup style resources and ecosystem-level channel activity. Current evidence better supports an enabling, aggregation, or amplification role than a mature stand-alone intrusion profile.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1589 | Gather Victim Identity Information | TA0043 |
|
| T1596 | Search Open Technical Databases | TA0043 |
|
| T1593 | Search Open Websites/Domains | TA0043 |
|
| T1585 | Establish Accounts | TA0042 |
|
| T1565.001 | Stored Data Manipulation | TA0040 |
|
Hackpurgatory — Possible Spanish-speaking cybercrime-adjacent collective / tooling community
Classification: TLP:WHITE - Open Source Intelligence (OSINT)
Category: Cybercrime-adjacent actor / possible pseudo-hacktivist community / tooling and leak-adjacent ecosystem - Origin: likely Spanish-speaking LATAM ecosystem (low confidence)
Author: iQBlack CTI Team
Executive Summary
Hackpurgatory is assessed as a possible Spanish-speaking cybercrime-adjacent collective or community brand operating through a public website, Telegram presence, and open promotion of searchable “OSINT” or “breach lookup” style resources. Publicly accessible material does not support high-confidence classification as a mature intrusion group in the same sense as a ransomware program or a long-documented hacktivist collective. Rather, the current picture is that of a hybrid ecosystem node: part community branding layer, part tooling hub, and part amplification or networking surface.
Open-source material shows Hackpurgatory maintaining a public-facing site that frames itself as an ethical cybersecurity community while also exposing breach-search, endpoint, and lookup functionality. That tension matters analytically: the gap between public self-presentation and the operational implications of the exposed services suggests either reputational laundering, dual-use positioning, or a community that mixes legitimate curiosity with clearly risky or potentially abusive capabilities.
