Cyber Incident Victim: Top Channel
Date:
Jan 2020
Location:
Turkey
Summary
Anonymous Greece conducted a cyberattack against a Turkish television broadcaster, disrupting its services for over 12 hours in retaliation against Turkish hacking activities. The group claimed compromise of nearly 13,000 Turk Telecom routers using Turkish IP addresses, asserting control over these systems for potential future attacks. Their public statements accused Turkish leadership of supporting terrorism and referenced bilateral disputes over asylum seekers and detained soldiers. The hackers warned of escalating cyber operations ahead of upcoming elections in Turkey.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 18, 2020, the hacktivist group "Anonymous Greece" executed a sustained cyber attack against Turkish television channel Top Channel 24 TV (www.yirmidort.tv), lasting over 12 hours. The attack was framed as retaliation against Turkish hackers for prior cyber operations and political grievances against the Turkish government. In a public statement published on medium.com, Anonymous Greece accused Turkish President Recep Tayyip Erdogan of killing Kurds and attempting to reestablish ISIS through military operations in Afrin, Syria. The group condemned Turkish hackers for supporting Erdogan's administration, labeling them "terrorists," while contrasting Turkey's detention of two Greek soldiers who accidentally crossed the border during fog with Greece's asylum grant to eight Turkish officers. This political framing established the attack's motivation as both retaliatory and ideological.
Anonymous Greece claimed technical success through the compromise of 12,987 Turk Telecom routers using Turkish IP addresses, declaring control over these systems for future offensive operations. As evidence, they published two unspecified charts alongside their declaration that "All of your servers and routers belong to us." The primary observable impact was the prolonged disruption of Top Channel 24 TV's online presence. No details regarding defensive measures or restoration efforts by the channel or Turk Telecom were disclosed in the statement. The group concluded with a threat to escalate attacks during Turkey's upcoming elections, signaling intent for continued operations tied to political timelines. The incident demonstrated hacktivist use of DDoS or infrastructure attacks to amplify geopolitical messaging, though specific technical methodologies beyond router compromises remained unelaborated in available disclosures.