Sources: Turkey-backed hackers have used DNS hijacking to obtain login credentials, targeting ~30 EU and Middle East governments and organizations since 2018
The technique itself keeps proving durable: years later, the UK attributed near-identical credential theft to Russia-linked APT28 hijacking MikroTik and TP-Link routers, showing DNS-and-routing interception has become a shared playbook across state actors rather than a one-off.
First-order effects
Roughly 30 EU and Middle East governments and organizations named in the reporting face immediate credential rotation, DNS record audits, and registrar lock-downs, since hijacked domains hand attackers valid-looking login pages rather than exploit-prone endpoints.
Ankara faces direct diplomatic exposure: the attribution ties a state actor to intrusions against EU governments, complicating Turkey's simultaneous push for EU-style tech regulation and deeper institutional ties.
Second-order effects
Registrars and DNS providers become the pressure point — if state campaigns keep working through them, governments will force stricter ownership verification and faster abuse response on the domain supply chain, raising costs across the hosting industry.
If the pattern holds — Talos's 2019 findings, this attribution, then APT28's router hijacking — credential interception at the network's routing layer becomes a normalized instrument of state espionage, pushing DNS governance toward treated-as-critical-infrastructure status and likely multilateral rules of engagement.
Attribution journalism of this kind hardens into a standing enforcement track: named state campaigns increasingly trigger coordinated diplomatic responses and sanctions debates rather than quiet remediation.
The trend: State-backed hacking is migrating up the stack from compromised endpoints to the internet's routing and DNS layer, where one hijack harvests credentials from many victims at once.
A massive cyber espionage campaign, which we found so spooked US intelligence that it changed how the government handles DNS registration, was the work of hackers aligned with the Turkish government https://www.reuters.com/...
Hackers acting in Turkey's interests believed to be behind cyberattacks targeting governments & 30+ organizations in Europe & the Middle East. “Victims include Cypriot & Greek government email services & Iraq's national security advisor, the records show.” https://www.reuters.com…
This is interesting. But while I was about to register this in my cyber incident database, I read the report carefully: none of the attacked countries, except Cyprus, actually confirm the attack, nor GCHQ, DHS or FBI can attribute the attack. Very odd. https://www.reuters.com/...
We try to be very transparent about how we know what we know since this is an arena ripe for misdirection and confusion. (If you're interested in learning more about Turkish hacking ops I would suggest checking our their MIT) https://www.reuters.com/... https://twitter.com/...
“The attacks highlight a weakness in a core pillar of online infrastructure....hackers were able to redirect visitors to imposter websites, such as a fake email service, and capture passwords and other text entered there.” https://www.reuters.com/...
We first began hearing word about how big a deal this hack was from our sources after a great report by @TalosSecurity. Our sources told us the hackers had gained access giving them the ability to intercept ALL INTERNET TRAFFIC going to several countries in the Middle East
Very interesting story by @Bing_Chris @jc_stubbs @josephmenn, including because of the DNS hijacking involved. “While small-scale DNS attacks are relatively common, the scale of these attacks has alarmed Western intelligence agencies.” https://www.reuters.com/...
Other high profile �� victims included: the email services for the entire government of Cyprus, the Freemason group in Turkey, a key undersea cable provider situated in Cyprus which routes large portions of the internet throughout the Middle East
The operation, known within the cyber research community as “SeaTurtle,” exploited weaknesses in DNS to hack hundreds of high profile victims, including entire foreign intelligence agencies. Notable victims also included a human rights group negotiating a ceasefire in Syria.
Exclusive: Sweeping cyberattacks targeting government and other organisations in Europe and the Middle East are believed to be the work of hackers acting in the interests of the Turkish government, Western officials told @Reuters https://www.reuters.com/... https://twitter.com/..…
Important phrasing: “acting in the interests of the Turkish government.” I appreciate that the reporters captured this, since it's different than saying it was the Turkish government. Also note the use of Diamond Model features: victim + infra. #FOR578 #CTI https://twitter.com/..…
Waves of cyberattacks, occurring since early 2018, have breached at least 30 organisations in Europe and the Middle East, including government ministries, embassies and security services, according to a review of public internet records by @Reuters https://www.reuters.com/... htt…