IsHaKdZ

Profile narrative

IsHaKdZ is a threat actor known by the alias IsHaKdZ, with publicly available information indicating a possible connection to Turkey. The actor first came to attention in May 2018 after exploiting a vulnerability in the Ticketfly ticketing platform. This incident resulted in website defacement, the theft of customer and client data, and a ransom demand of one bitcoin. The actor communicated directly with media outlets, claiming to have accessed a complete database containing names, addresses, email addresses, and phone numbers, and threatened to release additional “backstage” information if the demand was not met.

The targeting observed in the Ticketfly case points to the event‑ticketing sector, although no broader sectoral pattern is documented in the source material. The actor’s stated objectives appear to include financial extortion through the bitcoin ransom and causing operational disruption by defacing the site and forcing the victim to take systems offline. The tactics described involve identifying and exploiting a web‑application vulnerability, using the access to exfiltrate personal data, and employing website defacement as a pressure tactic. No specific malware families, toolkits, or initial‑access vectors beyond the vulnerability exploit are mentioned in the available reports.

Attribution to any state sponsor, criminal consortium, or larger threat‑actor group is not established in the public sources; the only linkage is the alias IsHaKdZ and the geographic hint of Turkey. The Ticketfly incident remains the sole publicly reported operation associated with this actor, representing a notable campaign that combined data theft, extortion, and service disruption. No further campaigns or additional TTP details are provided in the supplied context.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.