Threat Actor Characterization
Excluidos
ID: 8e9f7589833d19dda8d4310736e0cff630791Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
eca1afd98bdf84e744904b1ed65fe2d0 | Aero | Unknown | member-of | Cybercrime |
|
|
cc3089899d85cc334e40f0109f250d4b | Chigua | Unknown | member-of | Cybercrime |
|
|
ead4c472432b3e4899742370de737fb5 | Des | Unknown | member-of | Cybercrime |
|
|
adb3f9042b9f15e723658ffb87fa6888 | F Gov | Unknown | member-of | Cybercrime |
|
|
e900044a1879f1050401d3885a1be631 | Geo | Unknown | member-of | Cybercrime |
|
|
95bf770a3cd804777e2f92e840101c34 | Hard | Unknown | member-of | Cybercrime |
|
|
aaa7e00bd6e43ba6a05c6fa5d0de6bf2 | Tulio | Unknown | member-of | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Excluidos is modeled as a weakly validated Spanish-speaking hacktivist / defacement identity with likely focus on public-facing web compromise and symbolic impact.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1505.003 | Web Shell | TA0003 |
|
| T1491.001 | Internal Defacement | TA0040 |
|
| T1491.002 | External Defacement | TA0040 |
|
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Hacktivism / Defacement — Origin: Unknown (Spanish-speaking nexus; LATAM or Spain plausible)
Author: iQBlack CTI Team
Executive Summary
Excluidos is best modeled as a probable Spanish-speaking hacktivist / defacement identity whose open-source footprint remains weak and insufficiently documented for high-confidence actor profiling. The currently available public trace does not support a mature dossier built around stable infrastructure, a well-documented member roster, or a repeatable set of technically attributed intrusions. Instead, the most defensible assessment is that Excluidos represents a small or short-lived defacement-oriented identity operating in the broader Spanish-speaking cyber-claim ecosystem.
Confidence is low-to-medium that Excluidos exists as a genuine operational label rather than a one-off alias or recycled branding. Confidence is low regarding country of origin, leadership, tooling, and campaign scale. The user-provided characterization of Excluidos as a LATAM-oriented or possibly Spanish group is analytically plausible because the name, probable linguistic environment, and reported attack style fit the wider Spanish-speaking hacktivist/defacement scene, but public validation remains too thin to close that assessment confidently.
