Bozkurtlar
Attribution profile
- Type
- Activist
- Location
- Turkey
- Known incidents
- 9 incidents
- Sources
- 5 sources
- First seen
- 2015-08-16
- Last seen
- 2016-05-14
- Updated
- 2026-10-14 19:53
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Bozkurtlar, also known as Loups gris or Grey Wolves, is a Turkish hacker group that has been linked to a series of data‑theft incidents against financial institutions and occasional website defacements. The group’s activity has focused on banks in Asia and the Middle East, where it has exfiltrated customer transaction records, credentials and contact information, and in one case leaked several gigabytes of internal files including PHP scripts, financial reports and server backups. Public reports indicate that the intrusions relied on SQL injection vulnerabilities and the use of a tool called Hajiv to extract data. In addition to financially motivated breaches, Bozkurtlar claimed responsibility for defacing the UNICEF India website in August 2015, posting a protest message against several governments and international bodies and stating that the goal was to publicize grievances rather than harm the humanitarian organization. While the group has asserted responsibility for attacks on Qatar National Bank, InvestBank and others, independent analysts have noted that some of the leaked data appeared to be recycled from earlier breaches, and no definitive link to state sponsorship or a larger criminal consortium has been established in open sources. Representative operations include the May 2016 leak of data from multiple banks such as The City Bank (≈11 MB), Trust Bank (≈96 KB), Business Universal Development Bank (≈251 MB), Sanima Bank (≈47 MB) and Commercial Bank of Ceylon (≈6.97 GB), and the August 2015 UNICEF India website defacement.
Incidents
Attributed incidents are available to members.
9 incidentsSources
Sources available to members: 5 sources.