Anka Neferler
Attribution profile
- Type
- Activist
- Location
- Turkey
- Known incidents
- 8 incidents
- Sources
- 1 source
- First seen
- 2020-01-17
- Last seen
- 2020-01-23
- Updated
- 2026-10-12 13:50
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
The threat actor known as Phoenixs Helmets, also operating under the aliases Anka Neferler Tim and Anka Neferler, is based in Turkey. It has conducted denial-of-service attacks against Greek government and business targets, including parliamentary sites, ministries of foreign affairs, finance and intelligence, the national intelligence service, and the Athens Stock Market, using traffic‑flooding techniques that forced authorities to disconnect servers. The group states its actions are retaliatory for perceived Greek opposition to Turkey‑Libya economic agreements and broader Eastern Mediterranean gas disputes, indicating a disruption‑oriented motive rather than financial gain or espionage. No malware, phishing or specific tooling beyond volumetric DoS methods is described in the reporting, and there is no public evidence linking the group to a state sponsor or criminal consortium. A representative campaign occurred in January 2020 when the group claimed responsibility for a series of DDoS disruptions that took down multiple Greek government websites amid heightened diplomatic tensions over Aegean Sea and Libya‑related issues.
Incidents
Attributed incidents are available to members.
8 incidentsSources
Sources available to members: 1 source.