Turkish Nationalists Hacking American Media Personalities

ZeroFOX Alpha Team has identified an increase in known Turkish nationalist hacker group Ayyıldız Tim targeting American media personalities and organizations for Twitter account takeovers since at least mid-August 2018, likely because of recent, ongoing economic tensions between the United States and Turkey. The Turkish group—also sometimes known as the Turkish Cyber Army—has hacked up to five American news reporters since mid-August, including most recently on August 20.

In at least three of the cases, Ayyıldız Tim hacked the Twitter profiles of the reporters, changed the Twitter handle (thus losing verified status), changed the background image to an Ayyıldız Tim-related image, and posted tweets stating the account had been hacked by the group. The group subsequently used the hacked accounts to post Turkish military and political propaganda, tweets supporting Turkish president Recep Tayyip Erdogan, and anti-American sentiments.

Ayyıldız Tim may be currently targeting individuals that it believes have access to or influence over the president and his decisions with regard to Turkey, particularly American media figures and those that President Trump follows on Twitter. In posts on hacked accounts, the group has referenced taking control of the accounts’ direct message (DM) capabilities. In January 2018, Ayyıldız Tim hacked a former Fox News reporter’s Twitter account and used it to DM American president Donald Trump, who follows the reporter. Ayyıldız Tim has also used hacked accounts to tweet messages directed at President Trump.

Figure 1: Example of Hacked Account Post

A common tactic of Ayyıldız Tim is to compromise accounts in their primary target’s friend network, and then pivot through these accounts to phish their primary target. An academic described in detail how Ayyıldız Tim took over her Twitter account by using the account of noted economist Larry Summers to send her a phishing link in a direct message.

Other groups that Ayyıldız Tim has targeted in the past include American Christian organizations, academic institutions and schools, local and national government organizations, American banks, airlines, Pennsylvania-related groups, and countries such as Saudi Arabia, Israel, India, and France. The group appears to be solely motivated by political reasons and not by potential monetary gain.

Recommendations

Enable the Risky Name Change and Hacked Account Post rules for relevant entities
Avoid clicking on suspicious links, even from people you trust
Regularly change your password and enable two-factor authentication
Media organizations should conduct security checks for high-profile reporters and those they regularly interact with

Turkish Nationalists Hacking American Media Personalities

August 21, 2018|by Alpha Team

Recommendations

Sources