3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
TURK SIBER TIMI

TURK SIBER TIMI

ID: a4448eade0f29cc9e9509c078c0ef4f651339
Hacktivist Group Collective Defacement Crew Hacktivism
Threat types: Defacement
Turkey
Updated: 2026-01-13
Created: 2025-10-17
Progress: 56% Completeness: 59% Freshness: 50%
Operation zone: —
Aliases Limited alias preview
SIBERTIM TST TÜ************* TU****************
tü*********** — — —
Showing 2 of 5 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium
Actor Techniques page ATT&CK® Diagram

Türk Siber Timi (Turkish Cyber Team) — Turkish nationalist hacktivist label publicly stating a hierarchical, rank-based structure and a ‘justice’-oriented hacktivism ethos. Open sources show the group claims a founding date of 07 Dec 2017, a military-style chain of command, and non-monetary motives; its Instagram slogan frames the team as the “CYBER SUPPORT OF TURKISH HACK TEAMS.” Operational tenets include leaving messages rather than locking accounts and capturing chat logs during social-media account access.


Technique Technique name Tactics Evidence
T1491.002 External Defacement TA0040
  • 2017-12-07 — Group manifesto describes ‘hack’ as an instrument of justice and outlines rules of engagement for site/account intrusions (message drop instead of vandalism that prevents access). · ref
T1078 Valid Accounts TA0001 TA0003 TA0004 TA0005
  • 2017-12-07 — Rules for social-media operations include accessing accounts to leave warnings without changing passwords; guidance to record chats for potential later exposure. · ref
T1585 Establish Accounts TA0042
  • 2021-01-13 — Public-facing Instagram presence ‘@turkish_elite0101’ with tagline ‘CYBER SUPPORT OF TURKISH HACK TEAMS’ used for identity/reputation signaling. · ref
T1190 Exploit Public-Facing Application TA0001
  • 2017-12-07 — Manifesto implies intrusions into websites and social accounts; specific CVEs/vectors not listed (exploitation of public-facing apps plausible given defacement posture). INFERENCE. · ref
Strategic Intelligence
Limited preview
Last updated: 2025-10-17T19:41:09+00:00
Türk Siber Timi (Turkish Cyber Team)

CLASSIFICATION: Unclassified / Open Source


Executive Summary

Türk Siber Timi presents itself as a Turkish nationalist hacktivist collective with a ranked, military-style chain of command and a “justice”-oriented mission. The team’s manifesto states a founding date of 07 December 2017, names an internal leadership structure, and emphasizes non-monetary motives and “disciplinary” rules for members. The group’s Instagram handle @turkish_elite0101 markets it as “CYBER SUPPORT OF TURKISH HACK TEAMS,” positioning the label as a supportive/auxiliary banner within the broader Turkish hacktivist ecosystem. While public materials describe how they intend to handle intrusions (leave messages, avoid locking victims out, capture chat logs), open sources do not document specific operations, victims, or technical artifacts under this banner. Overall confidence in organizational self-description is medium; capability claims remain lightly evidenced in open sources.

  • 2017-12-07. Group claims founding; declares nationalist ethos and rank-based organization (ÜDY leadership; disciplinary system). — türksibertimi
  • 2017–ongoing. Manifesto outlines “justice” framing for hacks; sets rules of engagement (do not change passwords; leave message/warning; record chats; potential dox as second-stage pressure). — türksibertimi
  • 2021-01-13. @turkish_elite0101 Instagram post; profile tagline: “CYBER SUPPORT OF TURKISH HACK TEAMS.” — Instagram

Alleged actor / handle

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Empty Limited preview
No content yet.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Empty Limited preview
No content yet.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Empty Limited preview
No content yet.
IOC Appendix now
Saved successfully.
OSINT Library
Empty Limited preview
No content yet.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/6
Address Verification SOCMINT
www.instagram.com/tur************** Restricted Not integrated
www.instagram.com/tur********** Restricted Not integrated
www.youtube.com/cha***************************** Restricted Not integrated
www.youtube.com/@tu*************** Restricted Not integrated
www.tiktok.com/@si********* Restricted Not integrated
Address Verification SOCMINT
turksibertimi.wordpress.com Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–2 of 2 images
Hacked website evidence Free Preview
Hacked website evidence
Affiliation with TurkHackTeam Free Preview
Affiliation with TurkHackTeam