3C-INT | [Cyber]Crime Characterization for Intelligence

TurkHackTeam

ID: 68fe11ad7595a342f2272bf3fe964429

Hacktivist Group Data Leak Channel DDoS Crew Defacement Crew

Threat types: Kemalist, Political Ideology, Propaganda, DDoS Attack

Turkey ARM, AZE, BRA, CHN, CUB, ECU, FRA, DEU, IDN, ISR, TUR, GBR, USA, VAT

Updated: 2026-02-23

Created: 2025-10-10

Progress: 76% Completeness: 79% Freshness: 70%

Operation zone: Armenia, Azerbaijan, Brazil, China, Cuba, Ecuador, France, Germany, Indonesia, Israel, Turkey, United Kingdom, United States, Vatican City State

Aliases Limited alias preview

T.H.T	THT	Tu************	Tu***********
Tu****************	—	—	—

Showing 2 of 5 aliases in free preview.

Associated Threat Relationships

Limited preview

Related profiles 17
Related files 2

Related profiles

ID	Threat	Origin	Type	Categories
e23628936079ded334216d3accfa3c0356398	Anka Red Team	Turkey	affiliated	Hacktivist Group
827427124eaec43fc0c57ed0e974777163746	Arsenik	Turkey	founder	Hacktivist Group
7cd054ced56347feec03a3a89950f79037415	Attack Tim	Turkey	member-of	Hacktivist Group
1464a47b208b91857c91358cf02aff9c28588	Ayyıldız Tim	Turkey	co-actor	Hacktivist Group
40c0a201197ff347bc9103ffa5e363de19538	By_pulsar	Turkey	member-of	Hacktivist Group
afbf24a6a4dbcf9d8738cd2cd1a4f5de	Florian	Turkey	member-of	Hacktivist Group
02e2393ec741aa27f0b550eb9a82e184	Ghost Killer	Turkey	member-of	Hacktivist Group
3f2c21dbf7a7cc09419e0bf45e030c6984835	Herakles	Turkey	member-of	Hacktivist Group
11aa57d722910a573ebb7230501d1c2c37760	K3L0T3X	Turkey	member-of	Hacktivist Group
ca0d8804e1b2a66ce50d1c81db6631fc60357	Miler	Turkey	member-of	Hacktivist Group
1b091bb71792a59377a9c1226c2ceec350138	REVO*	Turkey	member-of	Hacktivist Group
520f57c91a8827cce8e9a55b63aa339942615	SAM LAMER	Turkey	member-of	Hacktivist Group
50739eac583496e5f197beae47c3940f17900	SaMuRa!	Turkey	member-of	Hacktivist Group
0cd21f79c52f053669339a4e75891e6590494	SecurityFaTHeR	Turkey	member-of	Hacktivist Group
8b5871e5bfa776c0538d7a300f5304ab	The GÃķlge	Turkey	member-of	Hacktivist Group
a4448eade0f29cc9e9509c078c0ef4f651339	TURK SIBER TIMI	Turkey	affiliated	Hacktivist Group
c0aa6f03a73ca75afa3051481b9b030014127	ZoRRoKiN	Turkey	founder	Hacktivist Group

Related files

Filename	Size	SHA-1	OS target	Identified
Türk Hack Team_1.5.5_APKPure.apk com.turkhackteam.mobil	5.8 MB	c74b30cc************************9c2992be		Propaganda
Türk Hack Team_1.5.4_APKPure.apk com.turkhackteam.mobil	5.8 MB	4e6fc396************************a5e70e0c		Propaganda

Free preview hides direct file links and partially masks file hashes.

Actor Network Graph

Open Network Graph

Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.

MITRE ATT&CK®

confidence: medium

Actor Techniques page ATT&CK® Diagram

TurkHackTeam (THT) — Turkish nationalist / Kemalist hacktivist collective active since 2002. Recurrently conducts high-visibility website defacements and network denial-of-service campaigns against governmental, commercial and civic targets (2013–2024).

Technique	Technique name	Tactics	Evidence
T1491	Defacement	TA0040	2013-09-13 — #OpNoWar — TurkHackTeam defaced ~750 websites under the #OpNoWar banner (large scale external defacements). · ref 2013-10-29 — Republic Day campaign — TurkHackTeam reportedly defaced 450+ websites celebrating Republic Day with Atatürk imagery (external defacements). · ref
T1491.002	External Defacement	TA0040	2015-04-14 — Vatican website attack — member(s) of TurkHackTeam claimed responsibility for taking Vatican site offline following Pope Francis' remarks; typical external defacement / disruption messaging observed. · ref 2017-02-15 — UK Police (NAVCIS subdomain) defacement — reported attribution to TurkHackTeam alias 'K3L0T3X' for an external defacement of a police subdomain. · ref 2017-10-29 — The International Affairs Association runs a blog called The Consul, which they said was hacked by a Turkish hacking group called Türk Hack Team. · ref 2013-07-21 — Multiple mid-2013 campaigns / mass defacements (e.g., 220+ / 430+ site incidents reported across several posts) — corroborates repeated use of external defacement as a tactic. · ref
T1498	Network Denial of Service	TA0040	2016-12 — Series of large-scale attacks (reported 2015–2016 period) against Russian and Iranian websites amid Syrian conflict — reported DDoS/availability attacks in OSINT reporting and OFPRA timeline. · ref 2023-01-23 — Claims of disruption against ICA Banken (Sweden) during #OpSweden — actor's social posts and OSINT captured a message claiming the bank was 'downed' (DDoS style campaign). · ref 2023-07 — Claimed cyber-attack against Star Alliance (July 2023) — reported by open sources as a THT-claimed availability/impact operation. · ref 2024-02-13 — Claims of DDoS against La Poste and Crédit Agricole (February 2024) — multiple OSINT outlets reported THT revendication of availability disruptions against French targets. · ref

Strategic Intelligence

Limited preview

Last updated: 2025-10-13T23:01:13+00:00

Preliminary Strategic Intelligence

TurkHackTeam (THT) — Turkish Nationalist Hacker Collective

Classification: Unclassified / Open Source

Executive Summary

TurkHackTeam (AKA "THT") — also known as Türk Hack Team or Turkhackteam (check aliases section) — is a nationalist-Kemalist hacker collective founded in 2002.

It defines itself as the “Turkish Cyber Army”, operating under a strong patriotic and pro-state narrative.

Full strategic intelligence is available in Analyst and Premium plans.

Executive Analyst Brief for CISO

Empty Limited preview

No content yet.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

Hunting Playbook

Empty Limited preview

No content yet.

Tip: Hover the section title to learn what’s included in Analyst / Premium plans.

Saved successfully.

IOC Appendix

Empty Limited preview

No content yet.

Saved successfully.

OSINT Library

Empty Limited preview

No content yet.

Saved successfully.

Social Medial & Communication

SOCMINT integrated: 0/30

Address	Verification	SOCMINT
`x.com/tht***`	Restricted	Not integrated
`x.com/tht**********`	Restricted	Not integrated

Address	Verification	SOCMINT
`www.facebook.com/tur**************`	Restricted	Not integrated
`www.facebook.com/tur***************`	Restricted	Not integrated
`www.facebook.com/Off*********`	Restricted	Not integrated
`www.facebook.com/Tur*****************`	Restricted	Not integrated

Address	Verification	SOCMINT
`t.me/htt************************`	Restricted	Not integrated
`t.me/THT***`	Restricted	Not integrated
`t.me/tur********`	Restricted	Not integrated
`t.me/tur*************`	Restricted	Not integrated
`t.me/tur************`	Restricted	Not integrated
`t.me/Tur**************`	Restricted	Not integrated
`t.me/Tur***********`	Restricted	Not integrated
`t.me/trk*****`	Restricted	Not integrated

Address	Verification	SOCMINT
`dis********************`	Restricted	Not integrated
`www.tiktok.com/@tr***********`	Restricted	Not integrated
`www.tiktok.com/@.t***********`	Restricted	Not integrated
`tr.linkedin.com/com*****************`	Restricted	Not integrated
`tr.linkedin.com/in/**************************`	Restricted	Not integrated
`www.instagram.com/off*********`	Restricted	Not integrated
`www.instagram.com/hac************`	Restricted	Not integrated
`www.instagram.com/tht***`	Restricted	Not integrated
`www*****************************`	Restricted	Not integrated
`nicegram.app/hub*********************`	Restricted	Not integrated

Address	Verification	SOCMINT
`bi***@turkhackteam.org`	Restricted	Not integrated
`bi***@turan.army`	Restricted	Not integrated

Address	Verification	SOCMINT
`turkhackforums.cjb.net`	Restricted	Not integrated
`www.turkhackteam.org`	Restricted	Not integrated
`www.turkhackteam.net`	Restricted	Not integrated
`www.slideshare.net/Tur**************`	Restricted	Not integrated