Anonymous Kurdistan

Profile narrative

The threat actor known publicly as Anonymous Kurdistan, also using the handle Muhmad Emad, has been identified as operating from Turkey. The actor emerged in early 2014 when it claimed responsibility for defacing two Turkish government websites. Aliases reflect a Kurdish nationalist orientation and a personal moniker used by the individual behind the activity. No further biographical details such as real name, age, or organizational ties have been disclosed in open sources.

The actor’s observed activity has been limited to targeting Turkish governmental online assets, specifically the Afyonkarahisar Provincial Disaster and Emergency Management portal. The defacement replaced legitimate content with a political message that demanded an end to alleged Turkish support for the Islamic State of Iraq and Syria (ISIS). The message included imagery portraying the Turkish Prime Minister as a dictator and employed abusive language toward anyone perceived as supporting ISIS. The actor provided links to the compromised sites and a mirror on the zone‑h archive as proof of the successful breach. The message contained the hashtag #OPTurkey and explicit language condemning ISIS supporters. These actions indicate a strategic objective centered on political disruption and the dissemination of a protest narrative rather than financial gain or espionage. Technical details about the intrusion method, malware families, or specific tools used have not been reported, leaving the initial access vector and tooling style unspecified in the available sources.

The January 2, 2014 defacement remains the only publicly documented operation attributed to Anonymous Kurdistan or Muhmad Emad. Turkish media coverage noted that the compromised sites were taken offline following the incident, and the government denied any involvement with extremist groups. No public attributions have linked the actor to a state sponsor, criminal consortium, or larger hacktivist collective. Consequently, the actor’s affiliation, capabilities, and potential for future activity remain undefined beyond the single confirmed website defacement.

Incidents

Attributed incidents are available to members.