/

Turkey behind cyber-attacks on Cyprus

3883 views
5 mins read

Cyprus government internet traffic and emails have previously come under attack from hackers officially sanctioned by Ankara, Reuters said quoting security experts.

It said sweeping cyber-attacks targeting governments and other organizations in Europe and the Middle East are believed to be the work of hackers acting in the interests of the Turkish government.

The hackers have attacked at least 30 organizations, including government ministries, embassies and security services as well as companies and other groups, according to a Reuters review of public internet records.

Victims have included Cypriot and Greek government email services and the Iraqi government’s national security advisor, according to Reuters evidence.

The attacks involve intercepting internet traffic to victim websites, potentially enabling hackers to obtain illicit access to the networks of government bodies and other organizations.

According to two British officials and one U.S. official, the activity bears the hallmarks of a state-backed cyber-espionage operation conducted to advance Turkish interests.

The officials said that conclusion was based on three elements: the identities and locations of the victims, which included governments of countries that are geopolitically significant to Turkey; similarities to previous attacks that they say used infrastructure registered from Turkey; and information contained in confidential intelligence assessments that they declined to detail.

The officials said it wasn’t clear which specific individuals or organizations were responsible but that they believed the waves of attacks were linked because they all used the same servers or other infrastructure.

The Cyprus government said in a statement that the “relevant agencies were immediately aware of the attacks and moved to contain” them. “We will not comment on specifics for reasons of national security,” it added.

Officials in Athens said they had no evidence the Greek government email system was compromised.

The Cyprus, Greek and Iraqi attacks identified by Reuters all occurred in late 2018 or early 2019, according to the public internet records.

The broader series of attacks is ongoing, according to the officials as well as private cybersecurity investigators.

Victims exposed

The attacks highlight a weakness in a core pillar of online infrastructure that can leave victims exposed to attacks that happen outside their own networks, making them difficult to detect and defend against, cybersecurity specialists said.

The hackers used a technique known as DNS hijacking, according to the Western officials and private cybersecurity experts.

This involves tampering with the effective address book of the internet, called the Domain Name System (DNS), which enables computers to match website addresses with the correct server.

By reconfiguring parts of this system, hackers were able to redirect visitors to imposter websites, such as a fake email service, and capture passwords and other text entered there.

All of the victims identified by Reuters had traffic to their websites hijacked – often traffic visiting login portals for email services, cloud storage servers and online networks — according to the records and cybersecurity experts who have studied the attacks.

While small-scale DNS attacks are relatively common, the scale of these attacks has alarmed Western intelligence agencies, said the three officials and two other U.S. intelligence officials.

Civilian organizations in Turkey have also been attacked, the records show, including a Turkish chapter of the Freemasons, which conservative Turkish media has said is linked to U.S.-based Muslim cleric Fethullah Gulen accused by Ankara of masterminding a failed coup attempt in 2016.

The Great Liberal Lodge of Turkey said there were no records of cyberattacks against the hijacked domains identified by Reuters and that there had been “no data exfiltration.”

The cleric has publicly denied masterminding the attempted coup, saying “it’s not possible,” and has said he is always against coups. (source Reuters)