Cyber Incident Victim: Hellenic Ministry of Foreign Affairs
Date:
Apr 2018
Location:
Greece
Summary
A cyber conflict emerged between Turkish and Greek hacker groups, with Turkish hackers defacing the Greek state-run ANA-MPA news agency and Suzuki's local website, posting messages accusing Greece of supporting terrorists. The Greek Foreign Ministry stated attacks were being neutralized promptly. In retaliation, Greek hackers from Anonymous Greece breached Turkish media outlet Top Channel 24 TV and claimed compromise of nearly 13,000 Turk Telecom routers, while exchanging politically charged messages referencing bilateral disputes over asylum seekers and detained soldiers. Turkish hackers continued threats against Greek entities, escalating tensions amid strained diplomatic relations. The incidents highlighted the use of cyber operations as substitutes for traditional military confrontations, targeting critical infrastructure and media platforms.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
In late April 2018, Turkish hacker group Akincilar (Invaders) initiated cyber attacks against Greek digital infrastructure. On April 30, they compromised the website of Greece's state-run ANA-MPA news agency, replacing its content with a bilingual Turkish-English message accusing Greece of supporting terrorist organizations. The same group subsequently defaced the Greek website of Japanese automaker Suzuki, displaying identical allegations. The Greek Ministry of Foreign Affairs acknowledged these incidents on May 3, stating that cyber attacks were "being neutralized immediately by the responsible authorities" through standard defensive protocols. In retaliation, hacktivist collective Anonymous Greece paralyzed the broadcasting systems of Turkish television network Top Channel 24. Through a Medium.com post, they accused Turkish President Erdogan of killing Kurds and attempting to rebuild ISIS through military operations in Afrin, while criticizing Turkey's detention of two Greek soldiers who had accidentally crossed the border during foggy conditions 63 days prior. Anonymous Greece additionally claimed to have compromised 12,987 routers belonging to Turk Telecom, declaring control over Turkish network infrastructure for potential future attacks.
Akincilar escalated hostilities by issuing direct threats against Greek citizens through breached platforms, warning they would be "thrown into the sea" like their ancestors, while accusing Greece of supporting FETO, an organization Turkey designates as terrorist. The cyber conflict intersected with ongoing diplomatic tensions, including Greece's granting of asylum to eight Turkish military officers in 2016 and Turkey's prolonged detention of the Greek soldiers. Cybersecurity analysts observed that these reciprocal attacks reflected deteriorating bilateral relations, with Jorgos Tzogopoulos of the University of Thrace noting the incidents signaled replacement of conventional military confrontation with digital warfare. The timing coincided with Turkey's impending general elections, suggesting potential for intensified cyber operations. No specific technical details regarding attack vectors, data exfiltration, or financial impacts were disclosed by either government, though the incidents demonstrated successful website defacements, temporary media outlet disruption, and claims of critical infrastructure penetration. Both nations maintained their standard public response protocols without announcing additional defensive measures beyond existing cybersecurity frameworks.