CSIDB logo
Threat actor

Anonymous Greece

Attribution profile

Type
Activist
Location
Greece
Known incidents
7 incidents
First seen
2018-04-30
Last seen
2020-01-18
Updated
2026-07-31 03:02
Aliases
1 alias

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

Anonymous Greece is a hacktivist group that operates under the alias Anonymous Greece and is known to be based in Greece. The group presents itself as a retaliatory actor that responds to perceived cyber aggressions from Turkish hacker collectives, framing its actions within broader political disputes between the two countries. Its public statements emphasize political messaging rather than financial gain, and it has not been linked to any state sponsorship or criminal enterprise. The group’s activities are primarily directed at Turkish targets, including media outlets, telecommunications infrastructure, government websites, and emergency services, with the stated aim of disrupting services and conveying political accusations.

The group’s reported tactics involve claiming compromise of large numbers of Turk Telecom routers by exploiting Turkish IP addresses, asserting control over these devices to launch further attacks. In one incident they disclosed that they had hacked 12,987 routers and declared that all associated servers and routers belonged to them for use in any future operation. Anonymous Greece has also carried out prolonged disruptions of Turkish television broadcasting, notably keeping the Top Channel 24 TV channel offline for more than twelve hours and publishing charts to substantiate their claim. Beyond router exploitation, the group has targeted Turkish websites, email systems, government VoIP platforms, and emergency call infrastructure, employing denial‑of‑service‑like effects that forced victims to disconnect services to limit damage. Their communications are typically posted on medium.com, where they issue statements addressed to Turkish officials, citizens, and hacker groups.

Attribution to Anonymous Greece remains confined to its self‑identification as a hacktivist collective; no credible public evidence ties it to a nation‑state intelligence apparatus or to a formal criminal consortium. The group frames its operations as direct retaliation against Turkish hacker entities such as Anka Neferler and Akincilar, citing specific grievances related to asylum seekers, detained soldiers, and bilateral diplomatic tensions. This retaliatory posture is consistently reflected in the timing and targeting of its attacks, which follow reported Turkish cyber operations against Greek institutions. Consequently, the group’s affiliation is best understood as a loosely organized, ideologically driven actor operating within the broader hacktivist landscape.

Notable campaigns attributed to Anonymous Greece include the January 18 2020 cyber‑attack on the Turkish television broadcaster Top Channel 24 TV that lasted over twelve hours and was accompanied by claims of compromising nearly thirteen thousand Turk Telecom routers. In April 2018 the group responded to Turkish defacements of Greek state media and corporate sites by targeting Turkish media outlets and asserting control over thousands of Turk Telecom routers, while exchanging politically charged messages about asylum cases and detained soldiers. Following the January 17 2020 denial‑of‑service attacks on Greek government and business entities, Anonymous Greece launched counter‑operations against Turkish websites and emergency services, disrupting email, VoIP, and emergency call infrastructure. These operations illustrate the group’s pattern of using claimed router compromises and service disruptions to convey political retaliation without pursuing financial theft or espionage.

Incidents

Attributed incidents are available to members.

7 incidents
CSIDB