CSIDB logo
Threat actor

Aslan Neferler Tim

Attribution profile

Type
Activist
Location
Turkey
Known incidents
4 incidents
Sources
3 sources
First seen
2016-09-07
Last seen
2017-09-27
Updated
2026-08-01 06:06
Aliases
3 aliases

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

Aslan Neferler Tim, also known as the Lion Soldiers Team, is a self‑described Turkish nationalist hacker group that has claimed responsibility for several cyber incidents targeting Austrian entities. The group identifies itself as responding to perceived affronts to Islam and the Turkish nation and has linked its actions to broader political disputes between Turkey and Austria, particularly Austria’s stance on Turkey’s European Union accession efforts and related diplomatic tensions. Their public statements reference perceived racism and the refusal of Austrian authorities to issue emergency visas to Turkish nationals stranded at Vienna’s airport after a flight was grounded for technical reasons.

The group’s activities have focused on Austrian institutions in the financial and aviation sectors, specifically the Austrian National Bank (OeNB) and Vienna International Airport, with indications that they intend to extend their operations to other private and public organizations in Austria. Their stated motivations are explicitly tied to political grievances rather than financial gain or espionage, and they have framed their actions as a response to what they describe as attacks on Islam and the Turkish nation.

In terms of tactics, the group has employed email‑flooding techniques that involve sending over five million messages per minute to overwhelm a target’s mail server, a method they described as distinct from a conventional distributed denial‑of‑service attack. They have also conducted website‑directed actions against the Vienna International Airport site, using social‑media platforms such as Twitter to claim responsibility and to communicate their grievances. No specific malware families, exploit kits, or intrusion vectors are mentioned in the available sources.

Notable operations attributed to Aslan Neferler Tim include a September 9 2016 email‑flood attack on the Austrian National Bank’s servers, which required two separate attempts before the bank’s server was taken offline, and a September 3 2016 incident in which the group asserted responsibility for a cyber‑attack on Vienna International Airport’s website. Following these events, the group announced its intention to continue targeting Austrian private and public organizations, citing ongoing political tensions between Turkey and Austria as the impetus for further activity. No public attribution to a state sponsor or criminal consortium has been made in the reported material.

Incidents

Attributed incidents are available to members.

4 incidents

Sources

Sources available to members: 3 sources.

CSIDB