TurkHackTeam
Attribution profile
- Type
- Activist
- Location
- Turkey
- Known incidents
- 9 incidents
- Sources
- 1 source
- First seen
- 2014-01-15
- Last seen
- 2023-04-04
- Updated
- 2026-10-19 01:34
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
TurkHackTeam, also known as TurkGuvenligi, is a Turkish hacking collective. The group has conducted website defacement attacks against Danish banks and government agencies, United Nations sub‑domains, the Syrian Electronic Army’s site, and the OpenSSL project, often citing political events such as Quran‑burning incidents or the #OpSaveGaza campaign as motivation. Their typical targets include financial institutions, government bodies, international organizations, and technology projects located in Europe and the Middle East, with the apparent strategic objective of causing disruption and delivering protest messages rather than financial gain or espionage. Observed tactics involve exploiting weak passwords or compromised hosting providers to gain access to web servers and then replacing site content with political statements, a method that does not rely on malware families or custom tooling beyond basic web defacement techniques. Public reporting shows no explicit state sponsorship or affiliation with criminal consortia; the group is described as a hacktivist collective operating from Turkey. Notable operations include the April 2023 defacement of Danish banks and government agencies, the July 2014 #OpSaveGaza attacks on UN sub‑domains, and the January 2014 takeover of the Syrian Electronic Army’s website via its hosting provider.
Incidents
Attributed incidents are available to members.
9 incidentsSources
Sources available to members: 1 source.