Turkey sees rise in cybercriminal activity due to influx of Russian hackers

Turkey sees rise in cybercriminal activity due to influx of Russian hackers

Turkey is experiencing a surge in cybercriminal activity after thousands of Russian men, many of whom are trained software engineers, fled their country to avoid military conscription for the war in Ukraine, Financial Times reports.

Some of the newly arrived Russian hackers perpetrate low-level scams and fraud to support themselves, joining forces with established Turkish counterparts to avoid detection, launder their earnings and sell credentials stolen from computers worldwide into the European market, the report said.

The Turkish police have launched an investigation into this growing number of hacker groups comprised of both Russians and Turks. These crews employ malware to obtain sensitive data but try to avoid targeting Turkish citizens so as not to attract attention from local law enforcement.

The malware, called Redline, is likely spread via illegal websites offering video games or pirated versions of popular software. Among other things, Redline is also able to steal cookies from victims’ browsers, allowing hackers to impersonate them online and even copy their saved credit card information.

The analysis of conversations in numerous Telegram groups revealed that the Russian hackers provided training to their Turkish “colleagues” in sophisticated coding in exchange for assistance in securing better prices for stolen data.

However, despite the collaboration, the Turkish hackers prefer to remain anonymous and focus on working with talented people rather than knowing their Russian allies personally.

Back to the list

Latest Posts

Cyber Security Week in Review: July 4, 2025

Cyber Security Week in Review: July 4, 2025

In brief: Google patches Chrome 0Day, the US is on the hunt for North Korean IT workers, and more.
4 July 2025
AI chatbots fall for phishing scams

AI chatbots fall for phishing scams

The models provided the correct URL only 66% of the time; nearly 30% of responses pointed users to dead or suspended domains.
3 July 2025
Chinese hackers exploited Ivanti flaws in attacks against French government

Chinese hackers exploited Ivanti flaws in attacks against French government

ANSSI believes that the Houken campaign is operated by ‘UNC5174’, an entity believed to act as an initial access broker for China’s Ministry of State Security.
2 July 2025