Cyber Incident Victim: State Atomic Energy Corporation ROSATOM
Date:
Jan 2016
Location:
Russia
Summary
Turk Hack Team, a Turkish hacker group, conducted a series of cyber attacks against Russian and Iranian entities in retaliation for geopolitical tensions, including the downing of a Russian jet by Turkish forces. The attacks involved defacing websites with anti-Putin messages, leaking personal data of Russian citizens from online shopping platforms, and executing DDoS campaigns that disrupted government sites, including the State Atomic Energy Corporation ROSATOM, Iranian presidential platforms, and multiple ministries. The group claimed responsibility for breaching thousands of sites, exfiltrating sensitive information, and causing operational downtime, framing their actions as nationalist retaliation against perceived adversaries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 3 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The Turk Hack Team (THT), a Turkish hacker group, escalated cyber operations against Russian entities following geopolitical tensions after Turkey downed a Russian Su-24 fighter jet near the Syrian border on November 24, 2015. On December 25, 2015, THT defaced over 2,000 Russian and Iranian websites, replacing content with anti-Putin messages accusing him of treachery and endangering citizens. The defacements included political rhetoric warning of consequences for Russia's leadership. The following day (December 26), THT launched "OpRussia," leaking personal data of hundreds of Russian citizens from online shopping platforms on Pastebin, containing names, cities, phone numbers, emails, and encrypted passwords. The group explicitly threatened continued attacks against Russian commercial and governmental targets.
On January 2, 2016, THT shifted tactics to large-scale DDoS attacks, successfully disrupting multiple high-profile Russian government websites. The State Atomic Energy Corporation ROSATOM was among the confirmed targets, along with the Ministry of the Russian Far East Development, Ministry of Construction, and Ministry of Customs. Iranian government sites including the Presidential Office, Ministries of Information, Foreign Affairs, and Energy were simultaneously attacked. THT publicly claimed responsibility via social media and a justpaste.it document containing target lists and downtime screenshots. The attacks caused measurable service disruptions to ROSATOM's online presence, though no data breach or physical infrastructure compromise was asserted. This campaign represented a coordinated retaliation effort exploiting geopolitical friction, leveraging both data leaks and denial-of-service tactics to maximize visibility and operational impact against strategic entities.