Threat actors
Every actor CyberSIXT, MITRE ATT&CK and the MISP Galaxy know, reconciled. A row opens the actor's page when CyberSIXT covers it, its Atlas view otherwise.
| Actor | Origin | Motivation | CVEs | In KEV | Techniques | Software | Sources |
|---|---|---|---|---|---|---|---|
| Sea TurtleTeal Kurma, Marbled Dust, Cosmic Wolf, SILICON | Türkiye | – | 3 | 2 | 27 | 1 | ATT&CK G1041 · MISP Galaxy |
| PROMETHIUMStrongPity, APT-C-41 | Türkiye | – | – | – | 11 | 2 | ATT&CK G0056 · MISP Galaxy |
| Aslan Neferler TimLion Soldiers Team, Phantom Turk | Türkiye | Hacktivism, Denial of service | – | – | – | – | MISP Galaxy |
| Ayyıldız TimCrescent and Star | Türkiye | Hacktivism, Denial of service | – | – | – | – | MISP Galaxy |
| Sath-ı MüdafaaA Turkish hacking group, Sath-ı Müdafaa, is encouraging individuals to join its DDoS-for-Points platform that features points and prizes for carrying out distributed denial-of-service (DDoS) attacks against a list of pre | Türkiye | Hacktivism, Denial of service | – | – | – | – | MISP Galaxy |
| TA482Since early 2022, Proofpoint researchers have observed a prolific threat actor, tracked as TA482, regularly engaging in credential harvesting campaigns that target the social media accounts of mostly US-based journalists | Türkiye | – | – | – | – | – | MISP Galaxy |
| TurkHackTeamFounded in 2004, Turkhackteam is one of Turkey’s oldest and most high-profile hacking collectives. According to a list compiled on Turkhackteam’s forum, the group has carried out almost 30 highly publicized hacking campa | Türkiye | Hacktivism | – | – | – | – | MISP Galaxy |
ATT&CK © 2026 The MITRE Corporation, reproduced with its permission. MISP Galaxy under CC0. Every link between an actor and a CVE is a stored, sourced link. Data as of 2026-11-14.