Cyber Threat Actor: WKPF

The threat actor known as WKPF is referenced in open‑source reporting as a group of Turkish hackers who operate under the aliases Whiteweasel, Krypton, the pahtron and Fresh. Contextual data also lists the actor’s location as Russia, although the primary source identifies the perpetrators as Turkish nationals. No public attribution links the group to a state sponsor or a larger criminal consortium, and the available material describes them as an ideologically driven hacking collective rather than a financially motivated enterprise.

The actor’s observed activity targets the financial sector, specifically the online presence of Russian banking institutions. In the documented incident, WKPF defaced the website of Russia’s Ekonombank, replacing its homepage with political messages that condemned Russia’s actions after the downing of a Turkish jet near the Syrian border. The defacement served a disruptive and communicative purpose, aiming to convey a geopolitical protest rather than to steal data, extort funds, or conduct espionage. The reporting does not mention any malware families, specific initial access vectors, or distinctive tooling associated with the group, so those details remain unspecified in the open record.

The most notable operation attributed to WKPF is the January 18 2016 website defacement of Ekonombank, which rendered the bank’s primary domain inaccessible and redirected visitors to a maintenance notice on the online banking portal. The attackers provided proof of the compromise via a mirror on zone‑h.org and claimed responsibility in an interview with a news outlet. This action was contextualized within broader pro‑Turkish hacking activity that also included the defacement of the Russian embassy’s website in Israel. No additional campaigns or repeated patterns are described in the source material, leaving the Ekonombank incident as the sole publicly documented example of the actor’s behavior.