Turkmenbashi Bank

Summary

Turkmenbashi Bank and another state-owned commercial bank in Turkmenistan experienced website defacements by Syrian hacktivist Dr.Sha6h, who replaced their homepages with messages promoting awareness of Syria's situation. The attacker left minimal text on one bank's site while urging international intervention in Syria on the other, also compromising additional government-affiliated websites including those of a business union, cultural festival, and seismic research institute. All targeted sites remained defaced at the time of reporting, demonstrating a coordinated disruption of Turkmenistani online assets to advance geopolitical messaging.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 7, 2014, the official websites of Turkmenistan's state-owned Turkmenbashi Bank (tbbank.gov.tm) and PrezidentBank (presidentbank.gov.tm) were compromised and defaced by the Syrian hacktivist known as Dr.Sha6h. The attacker replaced the homepages of both banking institutions with unauthorized messages. PrezidentBank's site displayed a brief declaration stating "Hacked By Dr.SHA6H // Follow Me In Twitter: @DrSHA6H," while Turkmenbashi Bank's defacement contained a political appeal urging US and international intervention in Syria. The hacktivist simultaneously targeted multiple other Turkmen government-affiliated websites, including the Union of Industrialists and Entrepreneurs of Turkmenistan (tstb.gov.tm), the Nowruz Festival site (nowruz.gov.tm), and the Research Institute of Earthquake Engineering (seysmostroy.gov.tm). All compromised domains remained under the attacker's control at the time of initial reporting, with no restoration timeline provided.

The incident demonstrated a coordinated digital protest campaign focused on Turkmenistani governmental entities. Dr.Sha6h's defacements followed their established pattern of targeting international government websites to amplify awareness of Syrian geopolitical issues. No technical details regarding intrusion methods, data compromise, or service disruptions beyond visual defacement were disclosed in available reports. The attack scope exclusively affected public-facing web properties, with no evidence suggesting deeper network penetration or financial system interference. Screenshots documenting the defacements were published contemporaneously, confirming the visual alterations and political messaging. All impacted websites remained non-operational in their original state during the immediate aftermath period documented in source materials.

Sources

Sources available to members: 1 source.