WKPF

Profile narrative

The threat actor known as WKPF operates under that alias and is also described in reporting as a group of Turkish hackers. According to the provided context, the actor’s location is listed as Russia. The group first came to public attention in January 2016 when it defaced the website of a Russian financial institution. The actors behind the attack identified themselves with the individual handles Whiteweasel, Krypton, the pahtron and Fresh. This combination of names appears in the defacement message and subsequent interview.

The targeting observed in the sole reported incident was the online presence of a Russian bank, placing the financial sector in the region of Russia as the focus. The actors replaced the bank’s homepage with political messages that referenced the downing of a Turkish SU-24 jet near the Syrian border, indicating an intent to disrupt the institution’s public facing service and to convey a geopolitical protest. No mention of malware, ransomware, or data theft appears in the source material, so the described technique is limited to website defacement and the use of a mirrored copy to prove the compromise. The attackers caused the bank to take its primary domain offline and redirect visitors to an online banking login page accompanied by a maintenance notice. This approach demonstrates a reliance on simple web‑based intrusion rather than sophisticated tooling or custom malware.

Attribution to a state sponsor or to a broader criminal consortium is not established in the available information; the actors are presented as an independent hacker collective. The sole publicly reported operation linked to WKPF remains the January 2016 defacement of Ekonombank’s website. The incident resulted in the bank’s site being inaccessible through its main domain and prompted a temporary shift to an alternate banking portal while the defacement was addressed. No further campaigns or additional victims have been documented in the supplied sources. Consequently, the profile of WKPF is confined to this single act of politically motivated website disruption.

Incidents

Attributed incidents are available to members.