Threat Actor Characterization
Z1k3n
ID: 7e65b663ae1b219a75c5bc62488e537f91843| 21k3n | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
409f0a8f7265fac0caeec8fea0a61f2046997 | adrxx | Mexico | co-actor | Cybercrime |
|
010a3816cc2d6934b44f5afceeb1399b65273 | Chronus Team | Mexico | member-of | Hacktivist Group |
|
264cf1620528fc9f070f4332f529394545444 | L0stex | Mexico | co-actor | Cybercrime |
|
2f7569e00c4d97aef5f2c2b3a4d2213f03521 | Lizard | Mexico | co-actor | Cybercrime |
|
9f534d342993237b013be8473f4100ee89243 | sh311hunter | Mexico | co-actor | Cybercrime |
|
fbafeeb1af0a2b998687c2e73d2c3c6d85069 | SoftVoid | Mexico | co-actor | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Z1k3n is a Chronus Team-linked operator/persona associated with leak-oriented activity affecting health, police, security, welfare, industrial, and public-sector targets across Latin America.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1005 | Data from Local System | TA0009 |
|
| T1567 | Exfiltration Over Web Service | TA0010 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) + Limited Human Intelligence (HUMINT) — TLP:WHITE
Category: Cybercrime / Hacktivism-adjacent intrusion and leak activity - Origin: Mexico (assessed, not confirmed)
Author: iQBlack CTI Team
Executive Summary
Z1k3n is assessed as a public-facing operator linked to the broader Chronus Team ecosystem, a Mexico-linked and wider LATAM leak-and-disruption cluster associated with intrusion, data exposure, and public reputational pressure against state-linked and socially sensitive institutions. Available evidence does not support treating Z1k3n as a standalone organization. Instead, the alias is best modeled as an operator/persona embedded in a semi-decentralized brand environment where multiple names publicly front specific incidents or target sets.
Current confidence is medium-high that Z1k3n is an active cluster-linked operator rather than a decorative co-branding alias. Public and commercial reporting tie the name to multiple data-leak events involving Mexico and Argentina, while internally supplied reporting adds fresh Argentina-linked activity involving security, police, and health-related institutions. This pattern is significant because it moves Z1k3n beyond single-incident visibility and into a recurring operational role inside the Chronus ecosystem.
