Cyber Threat Actor: Alsancak Tim

Alsancak Tim, also known as Alsancak Team or Alsancak Hacker Group, is a hacker collective that publicly identifies itself as a nationalist Turkish group and uses the tagline “injustice, oppression and war with all our might.” The collective has promoted an anti‑oppression ideology on its social media channels, although the specific motivations behind any particular operation have not been disclosed in open sources. Geographically, the group is associated with Turkey, though no further details about its organizational structure or base of operations are publicly available.

In January 2015 the group claimed responsibility for compromising the majority of the Ghanaian government’s primary websites, rendering them offline and displaying the message “Hacked by Alsancak Tim” on the defaced pages. According to the BBC report covering the incident, Alsancak Tim listed eleven Ghanaian domains on its social media accounts as targets it had successfully compromised. Ghanaian officials responded by stating that experts were working to restore the sites by the end of the day and were investigating the source of the breach. The report noted that this was not the first time Ghanaian government web properties had been targeted, referencing a 2012 defacement of the justice ministry’s site by individuals sympathetic to Argentina during a diplomatic dispute over a frigate, as well as simultaneous intrusions against two private banks in Ghana during the same year. The incident was situated within a broader context of heightened cyber‑activity, including mentions of cybersecurity concerns in the United States President’s State of the Union address and the recent hijacking of the U.S. Army Central Command’s Twitter and YouTube accounts by a group claiming ties to the Islamic State.

Open‑source reporting does not describe any specific malware families, exploit tools, or initial‑access vectors employed by Alsancak Tim in the Ghana operation or in any other attributed activity. Likewise, no public evidence links the group to a state sponsor, a criminal consortium, or any broader ideological network beyond its self‑described nationalist and anti‑oppression stance. The only publicly documented campaigns involve website defacements aimed at disrupting online services, with the 2015 Ghanaian government incident representing the most detailed example available in the referenced material. Consequently, the profile of Alsancak Tim remains limited to the observed aliases, the stated nationalist Turkish identity, the anti‑oppression rhetoric, and the confirmed disruption‑focused actions against Ghanaian government web assets.