Cyber Incident Victim: Türk Telekom
Date:
Apr 2018
Location:
Turkey
Summary
A cyber attack attributed to Greek hackers associated with Anonymous targeted Turk Telekom servers, disrupting the 24TV Live website's operations for several hours. This incident was described as retaliation for prior attacks by Turkish hacking group Akincilar against multiple Greek entities, including automotive websites and government platforms, amid tensions over asylum for Turkish military personnel and accusations of harboring terrorists. The attackers indicated intentions to continue disruptive actions coinciding with upcoming Turkish elections, reflecting ongoing geopolitical cyber hostilities between the groups.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around May 3, 2018, Turkish hacker group Akincilar ("Invaders") conducted a series of cyber attacks against Greek entities, including Honda Greece. The attackers infiltrated Honda Greece's website, replacing its content with a bilingual message in Turkish and English accusing Greece of "partnering" with terrorists by refusing to extradite eight Turkish officers who sought asylum after the 2016 coup attempt. The defacement message included threats referencing the Greco-Turkish War of 1919-1922, warning Turks would "throw you into the sea" as their ancestors had done. This attack rendered Honda Greece's website inaccessible on May 7, 2018. The group had previously targeted the Greek Foreign Ministry's website, the Athens-Macedonia News Agency, the Greek Handball Federation, and Suzuki-Greece in the same campaign, demonstrating a pattern of politically motivated attacks against Greek commercial and institutional targets.
In apparent retaliation, Greek hackers affiliated with Anonymous launched a counterattack on May 3, 2018, targeting Turk Telekom servers. This operation successfully paralyzed the 24TV Live website for several hours. The Greek hackers announced their actions were a direct response to the Akincilar attacks and signaled intentions to continue disruptive operations as Turkey approached upcoming elections. No technical details regarding the methods used in either attack campaign were disclosed in available reporting. The incident cycle exemplified escalating hacktivist tensions between Turkish and Greek groups, with reciprocal attacks focused on website disruptions and ideological messaging rather than reported data theft or infrastructure destruction.