Türkiye

This page covers cyber threats to Türkiye. It brings together official Turkish texts, government advisories from other countries, MITRE ATT&CK, and Brandefense research. Brandefense has an office in Ankara, and Türkiye is a market we follow closely.

Threat groups that official sources link to Türkiye

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

MuddyWater: the US Treasury said on 9 September 2022 that MuddyWater was assessed to be involved, as recently as November 2021, in a campaign targeting Turkish government entities. The Treasury attributes MuddyWater to Iran's Ministry of Intelligence and Security.

Lazarus Group: a joint advisory from the FBI, CISA and the US Treasury (AA21-048A) lists Turkey among the countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. These agencies attribute Lazarus Group to North Korean state-sponsored actors. MITRE ATT&CK says Lazarus Group used the Bankshot implant in 2018 against the Turkish financial sector.

APT38: a 2020 advisory from CISA, the US Treasury, the FBI and US Cyber Command (AA20-239A) says the North Korean group it calls BeagleBoyz likely targeted financial institutions in a list of nations from 2015 through 2020, and Turkey is on that list. The advisory says the BeagleBoyz overlap to varying degrees with APT38.

MITRE ATT&CK also describes groups that do not yet have a profile here. It says NEODYMIUM conducted a campaign in May 2016 and has heavily targeted Turkish victims, and that PROMETHIUM has run operations worldwide with a heavy emphasis on Turkish targets. It lists Turkey among the countries targeted by CopyKittens, an Iranian espionage group, and by Moses Staff.

Incidents on record

The incidents listed below are the major ones that foreign and Turkish media or officials reported widely, plus two that the US Treasury and MITRE ATT&CK document. Where sources disagree, the incident page says so. Small incidents are not listed.

How attackers target Türkiye: Brandefense research

Our own research has covered Türkiye many times. In summary, as our posts report:

State-linked espionage: a MuddyWater campaign against Turkey and the Arabian Peninsula continued the November 2021 campaign against Turkish private and government institutions, using PowerShell-based backdoors. The BugSleep analysis says investigations suggest MuddyWater may be targeting countries such as Turkey. The APT28 profile says the Pawn Storm campaign added the Turkish parliament and the Prime Ministry to its target list in 2016. Our May 2023 APT review covers a Sidewinder campaign against government authorities and individuals in Pakistan and Turkey. The Cicada report, the Mythic Leopard profile and the Lazarus profile list Turkey among targeted countries, and the BellaCiao analysis notes that its attackers sort victims by country code, including TR.

Banking trojans and the financial sector: Godfather is described as focused mainly on Turkish financial institutions, and our technical analysis and report describe fake pages imitating mobile banking applications used in Turkey. The OCTO trojan targets financial institutions in countries including Turkey.

Phishing and malware aimed at named sectors: a phishing campaign against the energy sector in Turkey used ransom e-mails sent through an SMTP relay service, and a malware analysis covers a file that targets employees of insurance companies in Turkey.

Ransomware and data theft: the AvosLocker research summary lists Turkey among its targeted countries, the Q2 2026 ransomware review links a FortiGate exploitation pattern to targeting of Japan and Turkey in Q1 2026 data, and a reported WhatsApp data sale listed Turkish citizens among those affected.

Politics and hacktivism: our hybrid warfare analysis describes DDoS attacks against Turkey on 14 December 2015, after Turkish jets shot down a Russian Su-24 aircraft on 24 November 2015. Two posts mention actors from Turkey: Gotham Stealer and a forum post about the Paris 2024 Olympics.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity, including Turkish-language dark web communities (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand. Customer stories from Türkiye: Tailwind Airlines (aviation) and Doğuş Teknoloji (technology).

Law and national strategy

Türkiye passed a Cyber Security Law, number 7545, on 12 March 2025. It was published in the Official Gazette on 19 March 2025. The law says its aim is to find and remove threats against the country in cyberspace, and to set rules that protect public bodies, companies and individuals from cyber attacks.

The law defines critical infrastructure as systems whose loss of confidentiality, integrity or availability could cause loss of life or large economic harm. It gives the new Cyber Security Presidency the tasks of determining which infrastructures are critical, setting up and supervising incident response teams (called SOMEs in Turkish), and carrying out cyber security audits and applying sanctions based on the result.

The current national plan is the National Cyber Security Strategy and Action Plan 2024-2028. It was issued as Presidential Circular 2024/11 and published on 7 September 2024. It is built on four themes: people, defense, deterrence and cooperation. It sets 6 strategic aims, 18 targets and 61 actions. It was prepared by the Ministry of Transport and Infrastructure together with public bodies, the private sector, civil society and universities.

How incident response is organized

The strategy document says USOM, the national incident response center, was set up to coordinate national response to cyber incidents and to act as the international contact point. A 2013 communique asked for sector incident response teams in critical infrastructure sectors, working around the clock under USOM coordination. USOM's own page now says the Cyber Security Presidency was founded under Presidential Decree 177 and Law 7545. It adds that USOM services such as CVE requests, incident reporting and malicious link lists continue to be published through siberguvenlik.gov.tr.

Sectors and rating

The strategy foreword names communications, finance, health and transport as examples of critical infrastructure. The same document says that, on ITU Global Cybersecurity Index data for 2020, Türkiye rose to 11th place among nearly 200 countries. That is a figure from the Turkish strategy document, and we have not checked it against a newer ITU edition.

Personal data

The Personal Data Protection Law, number 6698, was adopted on 24 March 2016. It created the KVKK, an authority with administrative and financial autonomy, based in Ankara. Under the law, a data controller must tell the person affected and the KVKK as soon as possible if personal data is obtained by others through unlawful means. The KVKK website publishes public announcements of such breach notifications.

The Turkish government texts we opened give no attack counts and name no threat groups for Türkiye. The groups and incidents on this page come from foreign government advisories, MITRE ATT&CK, official statements and news reports. Figures for Türkiye will come from Brandefense Atlas.