Hacktivist group

Team JXLL

TEAM JXLL is a Spanish-language hacking-oriented community with a public Telegram footprint and a Mexico-linked public categorization in open Telegram analytics. Available OSINT describes it as a community focused on helping the hacking community, while indexed posts and metadata show a blend of training material, scanner/tool references, enforcement/moderation messaging, and low-level cybercrime-adjacent terms.

The actor should currently be modeled less as a mature intrusion set and more as an enabling ecosystem: a channel/community where tools, tutorials, scanning references, and operational narratives may circulate. This matters because such communities can act as recruitment surfaces, amplification nodes, informal marketplaces, or bridges between low-level operators and more capable actors.

Potential alignment with HackPurgatory remains a working hypothesis. Public analytics expose HackPurgatory-linked web references in the TEAM JXLL channel context, but the evidence does not yet establish organizational dependency, shared administration, or common operators. INFERENCE (confidence: medium): the relationship is more likely ecosystem adjacency or channel-level cross-linking than a proven single organizational structure.

Created by iQBlack CTI Team
Contributors 1
Last updated 2026-09-03

ATT&CK

MITRE ATT&CK

T1190Exploit Public-Facing Application
T1588.002Tool
T1595.002Vulnerability Scanning

Research

Selected OSINT