Cyber Threat Actor: Akincilar

The threat actor known as Akincila, also referred to as Akincilar or Invaders, is a Turkish hacker group that has been active since at least 2017. The group operates from Turkey and uses the alias Akincila, which translates to 'Raiders' in Turkish, alongside the English translation Invaders. Their activities are characterized by website defacements that convey political messages rather than seeking financial gain. Public reporting identifies them as a hacktivist collective focused on expressing nationalist and partisan viewpoints.

Akincila primarily targets media outlets, corporate websites, and occasionally government-related online platforms. Observed victims include Greek state‑run news agencies such as ANA‑MPA, corporate sites of Suzuki Greece and Honda Greece, the Greek Handball Federation, and international news publishers like The Times of Israel and Asia Times. The group has also defaced Dutch websites during periods of diplomatic tension between Turkey and the Netherlands. Their actions consistently involve replacing the original homepage with images, flags, and textual statements that accuse the target of supporting terrorism or opposing Turkish interests.

The tactics observed in Akincila’s operations are limited to web defacement techniques; they gain unauthorized access to web servers and replace the existing content with their own messages and imagery. No references to malware families, exploit kits, or specific tooling appear in the available sources, so the group’s technical repertoire is described only by the observed ability to alter website files and upload visual elements such as children waving Turkish flags and Quranic verses. Their defacements often include multilingual text, combining Turkish, Arabic, and English to reach a broad audience.

Attribution to Akincila is based on repeated claims of responsibility in the defacement notices and on the group’s consistent use of the Akincila alias across incidents. No public evidence links the group to a state sponsor or to a larger criminal consortium; they are described as an independent hacktivist collective. Notable campaigns include the 2018 series of defacements against Greek media and corporate sites that coincided with heightened Greece‑Turkey tensions, the November 2017 hijacking of The Times of Israel and Asia Times to promote a pro‑Palestine narrative, and earlier actions against Dutch websites that featured pro‑Turkish messages and distributed denial‑of‑service activity.