Cyber Incident Victim: PrezidentBank
Date:
Feb 2014
Location:
Turkmenistan
Summary
State-owned commercial banks in Turkmenistan, including PrezidentBank, experienced website defacements by Syrian hacktivist Dr.Sha6h, who replaced their homepages with messages promoting awareness of the Syrian conflict and his social media presence. The attacker also compromised multiple additional government-affiliated websites, such as those for an industrialists' union, a cultural festival, and an earthquake research institute, leaving political appeals and hack signatures visible. All affected sites remained defaced at the time of reporting, demonstrating a coordinated disruption of Turkmenistani digital assets to advance the hacker's geopolitical messaging objectives.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 7, 2014, the official websites of Turkmenistan's state-owned PrezidentBank (presidentbank.gov.tm) and Turkmenbashi Bank (tbbank.gov.tm) were compromised and defaced by the Syrian hacktivist known as Dr.Sha6h. The attacker replaced the homepage of PrezidentBank with the message "Hacked By Dr.SHA6H // Follow Me In Twitter: @DrSHA6H," while Turkmenbashi Bank's site displayed a political statement urging the United States and other nations to intervene militarily in Syria, mirroring interventions in other conflict zones. This coordinated attack occurred simultaneously against both financial institutions, which serve as key commercial banking entities for the Turkmen government. The defacements remained publicly visible at the time of media reporting, indicating no immediate restoration efforts had been completed. No customer data breaches or financial system intrusions were mentioned in initial reports, with impact limited to website availability and reputational damage through visible defacement.
The incident formed part of a broader campaign by Dr.Sha6h targeting Turkmen government-affiliated digital assets. Additional compromised domains included the Union of Industrialists and Entrepreneurs of Turkmenistan (tstb.gov.tm), the Nowruz Festival cultural site (nowruz.gov.tm), and the Research Institute of Earthquake Engineering (seysmostroy.gov.tm), demonstrating expanded targeting beyond the financial sector to cultural and scientific institutions. All affected websites remained offline or displayed defacement pages during the initial reporting period, with no disclosed timeline for restoration. The attacker's stated motivation centered on raising international awareness about the Syrian conflict through high-visibility digital disruptions. Screenshots documenting the defacements were published by media outlets, confirming the scope of visible alterations to each website's front page. No claims of data exfiltration, financial fraud, or secondary attacks against banking infrastructure were substantiated in available reports.