3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
Ayyıldız Tim

Ayyıldız Tim

ID: 1464a47b208b91857c91358cf02aff9c28588
Hacktivist Group Collective Defacement Crew Hacktivism
Threat types: Hacktivism, Defacement, DDoS Attack
Turkey IRL, TUR
Updated: 2026-04-08
Created: 2025-10-10
Progress: 95% Completeness: 97% Freshness: 90%
Operation zone: Ireland, Turkey
Aliases Limited alias preview
ayyildiz Ayyildiz Team Ay********* Ay*******
Th**************** — — —
Showing 2 of 5 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Ayyıldız Tim is widely described as a Turkish nationalist hacktivist collective known for website defacements, DDoS activity, and propaganda-driven social-media account takeovers. Operations are typically public-facing and claim-oriented, with timing influenced by geopolitical narratives involving Turkey.


Technique Technique name Tactics Evidence
T1491.001 Internal Defacement TA0040
  • 2025-02-24 — Website defacement is listed as a core activity in vendor profiling and catalog descriptions. · ref
  • 2026-02-24 — Catalog descriptions characterize the group as performing defacements. · ref
T1498 Network Denial of Service TA0040
  • 2025-02-24 — Distributed denial-of-service activity is listed among known actions in vendor profiling and catalog descriptions. · ref
  • 2026-02-24 — Catalog descriptions characterize the group as performing DDoS attacks. · ref
T1585.001 Social Media Accounts TA0042
  • 2026-02-24 — Telegram channel presence represents use of social-media accounts for coordination and propaganda dissemination. · ref
T1534 Internal Spearphishing TA0008
  • 2018-01-16 — Social-media account compromise is described in analysis of a campaign attributed to the group. · ref
Strategic Intelligence
Limited preview
Last updated: 2026-02-24T17:20:26+00:00

Preliminary Intelligence — Ayyıldız Tim

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for Decision Makers — Ayyıldız Tim


Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — Ayyıldız Tim


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-02-24T17:21:21+00:00

IOC Appendix — Ayyıldız Tim (Operational Seed Set)


More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-02-24T17:21:32+00:00

OSINT Library — Ayyıldız Tim


2026-02-24 — Telegram — “Ayyıldız Tim official Telegram channel (@ayyildiztimresmi)”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/12
Address Verification SOCMINT
twitter.com/twi*********************** Restricted Not integrated
Address Verification SOCMINT
facebook.com/fac********************************* Restricted Not integrated
Address Verification SOCMINT
t.me/ayy************* Restricted Not integrated
t.me/Ayy*************** Restricted Not integrated
Address Verification SOCMINT
www.youtube.com/@Ay*************** Restricted Not integrated
ins***************************** Restricted Not integrated
plu*********************************** Restricted Not integrated
lin************************************* Restricted Not integrated
tik************************** Restricted Not integrated
Address Verification SOCMINT
www.ayyildiztim.com.tr Restricted Not integrated
www.ayyildiz.org Restricted Not integrated
forum.ayyildiz.org Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
No images found for this threat.