Loading threat actor…
RedHack is a Turkish leftist and communist hacktivist group known for politically motivated intrusions, website disruptions, defacements, account compromises, and the theft and publication of sensitive data. The group has primarily targeted Turkish government institutions and politically connected figures, framing its operations as retaliation against censorship, state repression, corruption, and government policy. Reported activity includes attacks against Turkish state web properties, unauthorized publication of protest messages on government sites, compromise of social-media accounts belonging to senior political advisers, and the exfiltration and release of government and ministerial communications. RedHack has also been associated with leaks of allegedly classified Turkish government documents and large email collections tied to senior officials. Its operations are characterized by public claims of responsibility, politically themed messaging, data disclosure, and disruptive actions intended to embarrass state institutions and influence public discourse. Based on the available facts, RedHack is best characterized as a hacktivist actor focused on Turkish state targets rather than a financially motivated or ransomware-oriented group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist group linked in the content to the sourcing of leaked emails belonging to Turkey’s energy minister Berat Albayrak and described as having previously targeted the Turkish government.
Hacktivist activity involving compromise of Mustafa Varank's Facebook account and publication of private message records tied to AKP figures.
Conducted a politically motivated cyberattack against Turkey’s Telecommunications Directorate website in protest of the government’s ban on YouTube and Twitter.
Claimed to have hacked Turkey's Ministry of Finance salary regulation system and altered civil servant salary-related records, including raising salaries, changing education status, and adding language compensation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.