Cyber Threat Actor: Turkey-A

The threat actor is known by the aliases Turkish Government, Turkey, and Turkey‑A and is assessed to operate from Turkey. It is described by Western officials as a state‑backed cyber espionage group acting in the interests of the Turkish government. Its strategic objective, as stated in public attributions, is to advance Turkish interests through espionage rather than financial gain or disruption. The actor primarily targets governmental and diplomatic entities, including ministries, embassies, security services, and related civilian organizations. Geographic focus has been observed in Europe and the Middle East, with victims in Cyprus, Greece, Iraq, Albania and Turkey itself. Targeting also extends to organizations that control top‑level domains and to civilian groups such as a Turkish chapter of the Freemasons. Public attribution links the activity to Turkish state interests based on victim profiles, infrastructure similarities to prior Turkish‑registered assets, and confidential intelligence assessments. While the exact individuals or units behind the operations have not been identified, officials assess that the attacks are linked through shared servers or infrastructure. The actor’s nexus to the Turkish state is therefore considered established, though no specific military or intelligence unit is named in open sources. This establishes the actor as a state‑aligned espionage group rather than a criminal syndicate.

The group’s hallmark technique is DNS hijacking, whereby it alters DNS records to redirect victims to fraudulent login portals and harvest credentials. By compromising entities that manage top‑level domains, it gains the ability to manipulate traffic for a wide range of victims. The attacks focus on intercepting traffic to email services, cloud storage platforms and other online networks, capturing usernames, passwords and other entered text. No specific malware families are mentioned in the reporting; the operation relies primarily on network‑level manipulation rather than malicious code deployment. A representative campaign is the sweeping DNS hijacking operation that began at least in early 2018 and affected at least thirty government ministries, embassies, security services and companies across Europe and the Middle East. Notable victims of this campaign include the Cypriot and Greek government email services, the Iraqi national security advisor, Albanian state intelligence and a Turkish Freemasons lodge. The operation resulted in the compromise of hundreds of non‑classified usernames and passwords, as confirmed by private cybersecurity investigators who monitored the redirected traffic. Although the Albanian State Information Service noted that the accessed systems held no classified material, the credential theft demonstrated the actor’s ability to harvest sensitive access information. The activity has been described as ongoing by Western officials and private investigators, indicating a persistent capability rather than a one‑off incident. This profile summarizes the publicly verified facts about the actor’s aliases, targeting, espionage objective, state affiliation, DNS hijacking TTP and the representative campaign observed in open sources.