3C-INT | [Cyber]Crime Characterization for Intelligence

Chronus Team

ID: 010a3816cc2d6934b44f5afceeb1399b65273

Hacktivist Group Hacktivism

Threat types: Hacktivism, Defacement, Intrusion, Data Leak

Mexico ARG, BRA, MEX, VEN

Updated: 2026-04-13

Created: 2026-03-26

Progress: 95% Completeness: 96% Freshness: 100%

Operation zone: Argentina, Brazil, Mexico, Venezuela

Aliases Limited alias preview

Chronus	Chronus Group	Ch*************	Ch***********
Ch***********	Ch******************	Ch*********	Kr**********
Te**********	Te*********	Te**********	—

Showing 2 of 11 aliases in free preview.

Associated Threat Relationships

Limited preview

Related profiles 26
Related files 0

Related profiles

ID	Threat	Origin	Type	Categories
409f0a8f7265fac0caeec8fea0a61f2046997	adrxx	Mexico	member-of	Cybercrime
28bbdb176d1c21e6243f132819364b01	Azazel	Mexico	member-of	Cybercrime
9f46237472e7183d47fb9abc553cd05e23713	Blackout	Unknown	member-of	Cybercrime
ee5b42ef7faa82d280c32145a06cea0f63354	Bogo	Mexico	member-of	Cybercrime
59db066b228d772444f22c29e844e7f403145	Chronus Jr.	Mexico	ally-of	Hacktivist Group
27c90c009a1ad7d4022232ed879356ea61163	Clart	Unknown	member-of	Cybercrime
15fc3950b7c08c0b533f05a11979539326088	Entropy	Mexico	member-of	Cybercrime
ec055994345eef707b7672e9ce25a41875607	Evorax	Unknown	member-of	Cybercrime
406301f561d69b60c7e9deeb639f8a3c	Gstxx	Unknown	member-of	Cybercrime
43335327478c06d3680d12e05cfefd3c29474	HackPurgatory	Mexico	ally-of	Hacktivist Group
495d99210a44577339ac6c35147358d227845	hackstge	Mexico	member-of	Cybercrime
cbef10f46a444eb5f615503f6380158a	HRPR	Unknown	member-of	Cybercrime
7e5b9d097d6d6dae17fa3838a05193d629242	Koda	Unknown	member-of	Cybercrime
264cf1620528fc9f070f4332f529394545444	L0stex	Mexico	founder	Cybercrime
2f7569e00c4d97aef5f2c2b3a4d2213f03521	Lizard	Mexico	member-of	Cybercrime
5e50c44d6c837fff5a66a6eb474401bb49561	Mel Moreira	Mexico	co-actor	Cybercrime
fb9fd8bad1eb99b5ffd606d3081a039142875	Mexican Mafia Hackers Team	Mexico	ally-of	Hacktivist Group
eaaefc39fb86989c66d4d6b39d79410223923	Mzk	Mexico	related	Cybercrime
3392d773cfbfa772f04db672ec04db9274249	Nihil	Mexico	member-of	Cybercrime
9f534d342993237b013be8473f4100ee89243	sh311hunter	Mexico	member-of	Cybercrime
016b5dcaa094959f984b311c5b81247279047	Shere	Mexico	member-of	Cybercrime
fbafeeb1af0a2b998687c2e73d2c3c6d85069	SoftVoid	Mexico	member-of	Cybercrime
5ee9ed75733b86171c1fe207615170e310687	SoyCripton	Unknown	member-of	Cybercrime
30cef197a8808ceeb0275c85f393b2a1	Wal13	Unknown	member-of	Cybercrime
d0e410ca11db8103b87c4f66e265906793083	Wrench	Unknown	member-of	Cybercrime
7e65b663ae1b219a75c5bc62488e537f91843	Z1k3n	Mexico	member-of	Cybercrime

Related files

No related files found.

Actor Network Graph

Open Network Graph

Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.

MITRE ATT&CK®

confidence: medium

Actor Techniques page ATT&CK® Diagram

Chronus Team is a Spanish-speaking hacktivist / doxing-oriented cluster linked in public reporting to Mexican public-sector data exposure, public leak threats, and at least one preserved defacement event in Argentina. The actor appears focused on government-facing targets and narrative amplification rather than on a clearly documented advanced malware-led intrusion platform.

Technique	Technique name	Tactics	Evidence
T1190	Exploit Public-Facing Application	TA0001	2025-12-10 — Public reporting tied Chronus Team to threatened defacement activity against Mexican government sites, consistent with targeting public-facing web assets. · ref 2026-03-24 — Preserved defacement of an Argentine municipal open-data portal indicates compromise of an internet-facing civic website. · ref
T1491.001	Internal Defacement	TA0040	2026-03-24 — The archived Catamarca municipal portal displayed 'HACKED BY CHRONUS' and hostile messaging, directly mapping to defacement. · ref
T1005	Data from Local System	TA0009	2025-12-12 — Reporting on the Hermosillo incident described a 738 MB package containing internal documents, personnel listings, and JSON files, consistent with collection from local or attached systems. · ref
T1078	Valid Accounts	TA0001 TA0003 TA0004 TA0005	2025-12-31 — INFERENCE (confidence: medium): Mexican government reporting noted that investigations would consider all hypotheses, including misuse of access credentials, making valid-account abuse a plausible access path in at least some incidents. · ref
T1567	Exfiltration Over Web Service	TA0010	2026-01-30 — INFERENCE (confidence: medium): Chronus Team’s public model relies on data publication and leak distribution, making exfiltration over web-facing services a plausible step between collection and public release. · ref
T1589.001	Credentials	TA0043	2025-12-12 — INFERENCE (confidence: low-medium): The reported exposure of personal and personnel-related records, including names and photos of police staff, is consistent with targeting and aggregation of identity-related victim information. · ref

Strategic Intelligence

Limited preview

Last updated: 2026-04-13T13:00:26+00:00

Preliminary Strategic Intelligence

CHRONUS TEAM — LATAM hacktivist / doxing-oriented cluster

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Category: Hacktivism / Data-leak and defacement cluster — Origin: Assessed Mexico-linked / wider LATAM nexus (INFERENCE, confidence: medium)

Author: iQBlack CTI Team

Executive Summary

Chronus Team is an emerging Spanish-speaking hacktivist and data-exposure cluster publicly associated with threats, leaks, and defacement activity affecting public-sector entities in Mexico and, more recently, Argentina. Open reporting from late 2025 through March 2026 consistently links the name “Chronus Team” to public leak threats, publication of government-related datasets, and at least one preserved defacement page claiming responsibility for hostile activity against an Argentine municipal open-data portal.

The group’s operational pattern appears centered on publicity, humiliation, and doxing leverage rather than on stealthy long-term access. Public messaging and media coverage indicate a preference for announcing deadlines, threatening “mass leaks,” and amplifying the perceived weakness of government security controls. This is consistent with a hacktivist or notoriety-driven model in which the media effect is part of the operation, not a by-product.

Full strategic intelligence is available in Analyst and Premium plans.

Executive Analyst Brief for CISO

Saved Limited preview

Executive Analyst Brief for CISO — Chronus Team

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Upgrade to access the full executive brief.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

Hunting Playbook

Saved Limited preview

Hunting Playbook — Chronus Team

Upgrade to access the full hunting playbook.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

IOC Appendix

Saved Limited preview

Last updated: 2026-03-29T01:43:50+00:00

IOC Appendix — Chronus Team

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

More IOC context for Research. Full appendix for Analyst and Premium plans.

Saved successfully.

OSINT Library

Saved Limited preview

Last saved: 2026-04-01T13:13:51+00:00

OSINT Library — Chronus Team

2026-03-31 — iQBlack — “Chronus Team after the threat: leaks, signaling, and institutional pressure in Argentina”

Full OSINT references available for Research / Analyst.

Saved successfully.

Social Medial & Communication

SOCMINT integrated: 0/15

Address	Verification	SOCMINT
`x.com/Tea*********`	Restricted	Not integrated

Address	Verification	SOCMINT
`t.me/Chr*********`	Restricted	Not integrated
`t.me/Chr***********`	Restricted	Not integrated
`t.me/Cho***********`	Restricted	Not integrated
`t.me/Cho************`	Restricted	Not integrated
`t.me/Chr************`	Restricted	Not integrated
`t.me/tea********`	Restricted	Not integrated
`t.me/+hW**************`	Restricted	Not integrated
`t.me/+4A**************`	Restricted	Not integrated
`t.me/+lA**************`	Restricted	Not integrated
`t.me/+CQ**************`	Restricted	Not integrated
`t.me/+6f**************`	Restricted	Not integrated