XMLCTL
XMLCTL is a cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance sector. It uses 4 MITRE ATT&CK techniques.
Also known as
- SectorJ149
- UAC-0050
- Techniques
- 4
- Exploited CVEs
- No CVE data
- First seen
- Oct 24, 2025
- Last seen
- Oct 24, 2025
- Record updated
Who They Target.
Sectors · 1
About XMLCTL.
A distinct cybercriminal actor employing different operational playbooks, including MSI-based loaders and commercial US-based hosting, to deploy NetSupport RAT.
Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.