Turkish intel uncovers cyber espionage network selling data on Telegram 

Türkiye’s National Intelligence Organization (MIT), in collaboration with Gendarmerie and the National Cyber Incidents Response Center (USOM), dismantled a cyber espionage network that had been illegally accessing and selling personal data from thousands of individuals across multiple countries, including Türkiye. The network was found to be operating through three Telegram channels.

Global cyber espionage investigation

• Initiation: The investigation was launched by the Ankara Chief Public Prosecutor’s Office after it was discovered that personal data, including that of Turkish citizens, was being sold through three Telegram channels, according to sources from Anadolu Agency.
• First operation: MIT, along with Jandarma and USOM’s cyber security teams, took control of the accounts linked to the espionage network. This led to the identification and subsequent arrest of four key suspects: M.E., B.E.K., H.O., and M.H.O.
• Second operation: Information obtained from these initial arrests led to a follow-up operation, resulting in the detention of seven additional suspects: B.B., S.S., H.M., E.S., B.B., S.M.D., and M.F.K.

Zoom in: Terror link

• MIT’s intelligence revealed that this cyber-espionage network was not only stealing personal data but also selling it to various entities, including terrorist organizations.
• The network’s activities spanned multiple countries, making it a significant threat to national and international security.

Turkish intelligence’s action

• Arrests: All 11 suspects were arrested and charged with crimes including “illegally obtaining or distributing personal data,” “unauthorized access to a computer system,” and “illegally obtaining documents related to state security.”
• Website shutdowns: As part of the operation, several websites associated with the network were taken down.
• Ongoing investigations: Authorities continue to investigate individuals who provided information to the network and those who purchased the stolen data. The investigation remains ongoing, with efforts to trace and dismantle all components of the network.