Turkey's Cyber Threat Landscape 2026

TL;DR: The heaviest threats Turkey faces in 2026 are ransomware, targeted phishing (phishing/BEC), supply chain breaches and AI-assisted social engineering. The most heavily targeted sectors are banking, the public sector, telecom, healthcare and the defense industry. The reasons are clear: geopolitical pressure, the pace of digitalization and the security gap on the SME side. The three most critical measures are MFA, immutable backups and regular patch management. This article was prepared in light of data from ENISA Threat Landscape, CISA and USOM.

What changed in 2026?

The short answer: attackers now operate faster, more automatically and more cheaply. Generative AI has made capabilities that were the privilege of state-backed groups three years ago accessible to the ordinary criminal. Models that write a phishing email in grammatically flawless Turkish, match a target-specific LinkedIn profile, and clone the owner's voice from a few seconds of audio are now in everyone's hands.

The second major shift is economic. The Ransomware-as-a-Service (RaaS) model has matured. Affiliate programs, dark web marketplaces, initial access brokers (IAB) and crypto mixing services together have built a full service chain. According to the findings of the CrowdStrike Global Threat Report, the time it takes an attacker to move from initial foothold to lateral movement in the victim network (breakout time) has dropped from hours to minutes.

Third, the supply chain. The 2020 SolarWinds incident was not a one-off nightmare but an instructive example, and then in 2023 the MOVEit and 3CX attacks showed that the same model could be applied by others too. When a SaaS provider falls, all of its customers fall with it.

Fourth, deepfakes. The Arup Hong Kong case, publicly reported in 2024, cost a transfer of 25 million USD over a deepfake video conference call. The attacker impersonated the faces and voices of the CFO and other executives live in a Zoom meeting. What this case demonstrates is not technical but social: how dependent corporate decision-making mechanisms are on the trust of "I looked at the screen, the voice sounded familiar."

Fifth, the rise of identity-based attacks. Instead of the classic "drop malware, roam the network" scenario, the attacker now directly steals credentials (infostealer logs, MFA bypass, OAuth token leakage) and walks in as a legitimate user. This both deceives EDR and makes log review harder, because technically it is a legitimate session. The Microsoft Digital Defense Report has been flagging this trend in red lines for years.

Sixth, the growth of the OT and IoT surface. Smart city infrastructure, industrial control systems, smart meters, IP camera networks: all of them are new hunting grounds for the attacker. The 2021 Colonial Pipeline case showed how a ransomware attack on an office IT network can also halt the OT side.

The situation specific to Turkey

Turkey's geographic and geopolitical position is a parameter in its own right within the cyber threat profile. NATO membership, the spillover effects of the Russia-Ukraine war, the Syrian border, the Eastern Mediterranean files: all of them make Turkey both a target and a transit point for state-backed actors. USOM regularly publishes bulletins on attack attempts against critical infrastructure.

According to BTK data, the number of internet subscribers and the volume of data traffic in Turkey continue to grow year over year, which directly expands the attack surface. The density of telecom infrastructure, the high penetration of mobile banking, and the prevalence of public services offered through e-Government create a rich target list for the attacker.

By sector, the most heavily targeted line up in this order: banking and finance (card data, SWIFT, mobile banking trojans), the public sector (politically motivated attacks and personal data breaches), telecom (for backbone access), healthcare (e-Nabiz and hospital information systems), energy and the defense industry (a strategic target for state-backed actors).

The geographic advantage also turns into an attack vector. The submarine cables passing through Turkey, the IXPs (internet exchange points in Istanbul), and the backbone route toward which a significant portion of Europe-Asia data traffic is directed create a position of high strategic and intelligence value. The defensive counterpart of this is that the cyber resilience level of telecom infrastructure becomes a direct matter of national security.

Another dimension is language. Until the last three years, producing Turkish content was a serious barrier for foreign attackers; emails with broken translations were an obvious red flag. Generative AI has removed that barrier. Fluent phishing text that fits corporate jargon and even catches local wordplay can now be generated within seconds. The Turkish user's intuition of "foreign attacker = broken Turkish" is no longer a reliable defense.

The 7 most dangerous threat categories

1. Ransomware

Groups such as LockBit, BlackCat/ALPHV, Cl0p, Play, Akira, 8Base and Black Basta operated actively throughout 2024-2025, and many continue to pose a threat into 2026 along with their successors. The business model is no longer single-stage. Double extortion has become standard: files are both encrypted and, before that, stolen and threatened with publication on a leak site. Some groups have moved to triple extortion, also calling the victim's customers and regulatory bodies.

When a data breach occurs under KVKK, notification to the KVKK Authority within 72 hours is required. The notification window for critical infrastructure operators to USOM is much shorter.

The official advice is clear: the joint CISA and FBI advisory is to not pay the ransom. There are two reasons: first, payment funds the criminal ecosystem; second, there is no guarantee that the key will work or that the data will be returned. Practical experience shows that in a significant portion of cases where payment was made, the data did not come back partially or fully.

An additional note for Turkey: paying groups on the OFAC sanctions list can create serious legal risk in any US-linked banking, payment or insurance chain. For this reason, the Turkey operations of multinational companies cannot make the payment decision alone; the global legal and compliance team gets involved.

On the defensive side, the three highest-yield practices are: first, Credential Guard and LSA Protection against LSASS and credential dumping; second, SMB v1 disabled plus no direct RDP access from the internet; third, backups made immutable (object lock, WORM media, offline transfer) so that they cannot be deleted even if the attacker becomes domain admin.

2. Phishing and business email compromise (BEC)

The classic phishing email lives on, not because it ended, but alongside much more complex variants. CEO fraud (executive impersonation), vendor invoice fraud (fake supplier invoice), Office 365 session hijacking (adversary-in-the-middle phishing), MFA bypass kits. The Microsoft Digital Defense Report has reported a serious increase in the volume of identity-based attacks in recent years.

There is an extra risk factor for Turkey: DMARC, SPF and DKIM configuration is still missing or loose (in p=none mode) at many organizations. This makes it easier for fake emails sent in the organization's name to land in the recipient's inbox. A quick check recommendation: validate your own domain's DMARC record with a tool such as dmarcian, and if it is p=none, plan the transition from the reporting stage to p=quarantine and finally to p=reject.

The signature of BEC attacks is typically this: a real supplier email account is compromised, the attacker silently reads the correspondence for weeks, then slips in the line "our bank account has changed, please make the transfer to the new IBAN." In such cases, classic technical controls often stay silent because the email genuinely comes from a legitimate account. The only effective control is procedural: when an IBAN change request comes in, out-of-band verification from the supplier's known phone number, and second-signature authorized approval.

3. Supply chain attacks

The 2020 SolarWinds Orion incident was the start of attacking a software product's update channel to reach its customers becoming an industry-standard tactic. The 2023 3CX and MOVEit Transfer (Cl0p) attacks showed the same model repeated across different vectors.

On the open-source ecosystem side, dependency confusion, typosquatting and malicious npm/PyPI packages are a serious threat. A package that infiltrates the CI/CD pipeline can reach production from the developer in a single move. The critical point for Turkey is SaaS dependency and third-party integrations. Every API key, every OAuth scope and every vendor access is an attack surface.

4. Zero-day vulnerabilities

Every month, dozens of security vulnerabilities are patched on Microsoft Patch Tuesdays, and a significant portion of them are already being exploited the moment they are published. The CISA Known Exploited Vulnerabilities (KEV) catalog should be tracked as the reference list of vulnerabilities confirmed to be under active exploitation.

In Turkey, the culture of patch management is still maturing. In ICS/OT environments there are systems left un-updated for years on the grounds that "production will stop." On the office side, Windows and Office updates are generally tracked, but delays on edge devices (firewall, VPN concentrator, mail gateway) leave critical vulnerabilities open.

A special note on edge devices: in the last three years, all of the major vendors such as Fortinet, Ivanti, Cisco ASA, Palo Alto and Citrix faced critical vulnerabilities that made it onto the CISA KEV list. These are devices at the internet edge, so within a day they enter the crosshairs of automated scanners. The patch SLA for edge must be far more aggressive than for the office, ideally 72 hours.

5. Social engineering and deepfakes

The Arup Hong Kong case (February 2024) showed that deepfakes are no longer an academic fear but an operational attack vector. Voice cloning technologies have become able to easily mimic natural spoken Turkish. Call-center social engineering, calling the IT helpdesk with a "reset my password" request, a fake executive in an internal Teams/Zoom meeting: all are scenarios that have come into the field.

On the defensive side, the principle of "out-of-band verification" is the basic rule. A transfer instruction that arrives by voice or video should never be verified through the same channel. Calling back from another known number or obtaining a second approval through an official channel is mandatory.

6. Cloud misconfiguration

Forgetting an S3 bucket left publicly open, accidentally committing an Azure Storage SAS token into a code repository, leaking a GCS service account key into a repo, leaving Kubernetes etcd exposed to the internet without authentication. These have been on the list for years yet still sit at the top of breach reports.

The Verizon Data Breach Investigations Report has reported for years that human error (including misconfiguration) accounts for a significant share of breaches. The Cloud Security Alliance's Top Threats publication places misconfiguration in the top three every year.

A practical checklist: use IaC (Terraform, Pulumi), a public access block policy for every bucket, SAS token lifetime and scope restrictions, Kubernetes RBAC and network policy, use a secret manager (never plaintext in the repo).

7. Insider threat

Edward Snowden and Anthony Levandowski (data leak from Google to Uber) are two publicly known reference cases. Data exfiltration after corporate resignation, deliberate insider leakage with financial motivation, or a wholly unintentional mistake (email to the wrong person, a wrongly shared link). All are evaluated under the same umbrella.

For detection, UEBA (User Entity Behavior Analytics) and DLP (Data Loss Prevention) solutions are critical. An anomaly can be caught with signals such as a user pulling data in a volume they do not normally download, connecting to a file share they do not normally access, or VPN activity outside working hours.

On the process side, the most critical control is the joiner-mover-leaver (JML) process. Which access a worker will receive when they start, how old access will be cleaned up when their position changes, and within what timeframe accounts and tokens will be deactivated when they leave. At a significant portion of mid-sized companies in Turkey, the "leaver" step is neglected; the former worker's email account or VPN access stays active for months. This is the favorite gap of deliberate insider leakage.

Sector target analysis

Finance and banking

BDDK regulations impose compliance obligations on financial institutions in Turkey above the world standard; this is both a requirement and a defensive layer. SWIFT attacks have historically been highly costly: the 2016 Bangladesh Bank case (81 million USD stolen) is still a textbook example.

Mobile banking trojans (families like Anubis, Hydra, ERMAC and SharkBot) target Turkish users with Turkish-localized overlays. APK sideloading and SMS phishing are the most common distribution channels. Card-not-present fraud and magstripe data continue to be harvested through e-skimming attacks.

Healthcare

The 2021 Ireland HSE ransomware attack is a clear case showing how a national health system can be paralyzed for weeks. In Turkey, e-Nabiz and hospital information management systems are a very large attack surface. Patient data is one of the personal data categories that sells at the highest price on the black market. KVKK imposes an additional protection requirement for health data under the scope of special-category data.

Public sector and defense

The APT groups documented in the MITRE ATT&CK framework (APT28/Fancy Bear, APT29/Cozy Bear, Lazarus Group, APT41, Turla, Sandworm) are state-backed actors. For a country at a geopolitical crossroads like Turkey, these actors are a chronic threat. Spear phishing, watering hole, supply chain and zero-day: all are in the TTP repertoire.

Defense industry companies attract intense interest especially in areas such as unmanned aerial vehicles, radar and electronic warfare. SOC 24/7 monitoring, threat intelligence feeds and red-team exercises are mandatory practices for this sector.

SMEs

The most vulnerable segment. Often there is no dedicated IT department, dependency on undirected off-the-shelf SaaS is high, and the security budget is zero. The ENISA SME report has stressed for years that a significant portion of SMEs lack adequate protection.

For the attacker, an SME is valuable in two ways: either it directly clears the profit threshold for ransom, or it becomes the supply chain door to a larger organization. A small accounting firm can be the door to a large holding company that is its client.

The practical economics for an SME are this: building a corporate SOC is not realistic, but an MDR (Managed Detection and Response) service can be procured. Packages such as Microsoft 365 Business Premium include MFA, conditional access, email DLP and Defender at a basic EDR level in a single license. For backup, an immutable target with Veeam or Acronis is sufficient; additionally, cloud object storage (S3 object lock plus versioning) provides very low-cost ransomware protection.

E-commerce

Magecart type payment-page skimming attacks infiltrate third-party script loads and silently steal card information. For PCI-DSS compliance, tokenization, the approach of never taking card data into your own system at all, correctly configuring the CSP (Content Security Policy) header, and script integrity (SRI) are mandatory hygiene practices.

In Turkey, separating card data from the merchant through local payment service providers such as iyzico, PayTR and Param is a common and correct model. But third-party JS that the checkout page depends on (analytics, chatbot, A/B testing) is still a risk.

Defense strategy: build the structure with NIST CSF 2.0

The NIST Cybersecurity Framework 2.0 was published in 2024 and added one new function to the previous version's 5 functions, making it 6.

GOVERN (new): Aligning cybersecurity decisions with corporate strategy, defining risk appetite, and senior management accountability. In Turkey this is no longer optional for boards of directors.

IDENTIFY: Asset inventory, data classification, third-party risk assessment, and a map of regulator requirements (KVKK, BDDK, EPDK).

PROTECT: Access control (MFA plus least privilege), encryption (at-rest plus in-transit), patch management, training. This function holds the most concrete ROI.

DETECT: SIEM, EDR/XDR, NDR, log collection and correlation, threat intelligence feeds. On the homegrown product side, options such as ULAK and KAOS are maturing day by day.

RESPOND: IR playbook, crisis communication plan, legal and PR coordination, USOM and KVKK notification flow.

RECOVER: Backup and restore drilling (if you have a backup but the restore has not been tested, you have no backup), business continuity, lessons learned.

Minimum security level (for SMEs)

  1. MFA everywhere. Especially email, VPN, admin panels and cloud consoles. Prefer TOTP or passkey over SMS.
  2. Patch management. Operating systems, applications, edge devices (firewall, VPN, NAS). Not monthly but continuous.
  3. Backup 3-2-1. Three copies, two different media, one offsite and immutable. What ransomware loves most is a single online-accessible backup.
  4. EDR/XDR. Classic antivirus is inadequate against polymorphic and fileless attacks. EDR performs behavior-based detection.
  5. Email security. SPF plus DKIM plus DMARC (p=reject is the goal), URL rewriting and attachment sandboxing at the gateway.
  6. Network segmentation. No flat network. Users, servers, IoT, guest Wi-Fi: each on a separate VLAN and ACL.
  7. Vendor risk assessment. SOC 2, ISO 27001 and a data processing agreement for every SaaS and integration provider.
  8. Phishing training. Not a once-a-year slide deck, but continuous simulation and micro-modules.
  9. IR playbook. "Who does what if there is an attack" must be written down. The phone numbers of the team that decides during an incident, a crisis communication draft, and the legal basis ready.
  10. KVKK compliance. VERBIS registration, privacy notice, explicit consent, data processing inventory, and a breach notification flow.

Incident response plan

SANS and NIST SP 800-61 offer a six-stage IR framework.

  1. Preparation. Playbook, team, tools, contact list and legal framework ready.
  2. Identification. SIEM alarm, user report, EDR trigger, external warning. A decision is made on whether it is an incident or a false positive.
  3. Containment. The affected machine is isolated from the network, compromised accounts are deactivated, and malicious IOCs are blocked.
  4. Eradication. Persistence mechanisms (scheduled task, service, registry run key, web shell) are cleaned up and the open vulnerability is closed.
  5. Recovery. Systems are restored from a clean backup, patched, returned to monitoring and validated.
  6. Lessons Learned. Post-mortem report, root cause, control improvement actions.

For critical infrastructure operators, the USOM notification obligation is very short, with a target of 3 hours in serious incidents. For a KVKK breach it is 72 hours. These timeframes must already be embedded in the text of the IR plan and in the team's habits.

How is AI changing defense?

It is a double-edged weapon. On the attacker side: automated phishing content generation, polymorphic malware variant generation, code vulnerability discovery, deepfake audio and video, reconnaissance automation. An attacker can now run a parallel attack against hundreds of targets single-handedly.

The same capability exists in defense. Anomaly detection, behavior analysis (UEBA), log correlation, threat hunting automation, IOC enrichment, alert triage, SOC analysis with natural-language querying. AI-assisted SOC products (Microsoft Security Copilot, CrowdStrike Charlotte, Google Sec-PaLM-based solutions) are attracting aggressive investment in this area.

There is a note specific to Turkey here. Foreign closed-source AI defense products create a data sovereignty problem depending on the sector and data sensitivity they connect to. Sending logs unencrypted and processing sensitive alert payloads in US or EU regions can create risk in terms of the regulator and KVKK.

The KAOS homegrown AI security engine developed by DSET was designed precisely to close this gap. It runs locally (zero external API requirement), has no cloud dependency, and logs and intrusion signals never leave the organization. It includes Turkish natural-language querying, MITRE ATT&CK technique matching, automated triage and a multi-expert agent architecture. This approach is a strategic choice both in terms of KVKK compliance and operational sovereignty.

There are three concrete use cases where AI defense has matured. First, alert triage: it is impossible for a SOC analyst to separate the real incident from 1000+ alerts a day; AI significantly reduces manual review time through noise filtering. Second, threat hunting: complex queries such as "show me RDP connections made from domain admin accounts in the last 30 days that have never been seen before" can be run within minutes using natural-language queries. Third, playbook automation: typical IR steps (isolate the host, disable the user, block the IOC) are applied in seconds instead of minutes through AI orchestration.

The limits of AI must also be clear. Hallucination risk is a disaster in defense decisions; halting the production line over a false-positive alarm on the grounds that "the AI confirmed it" creates serious cost. The anti-hallucination policy in KAOS's design answers exactly this point: the engine enforces mandatory source citation before producing an answer, and supports saying "I don't know."

Turkey's homegrown security ecosystem

Regulatory and operational institutions such as USOM, BTK and KVKK exist. TUBITAK BILGEM Cyber Security Institute is on the R&D side, while defense industry companies such as HAVELSAN, ASELSAN and STM work on the product and service side. University incubation centers, led by Hacettepe Teknokent, support the development of next-generation homegrown products.

The strategic importance of being homegrown rests on three main axes: first, data not leaving the country (KVKK and operational sovereignty); second, supply chain independence (no risk of being cut off during geopolitical tension); third, calibration specific to the local threat environment (Turkish content, local APT TTPs, sectoral regulatory compliance).

On the academic side, Hacettepe, METU, Sabanci, Bilkent, GTU, ITU and several other universities have opened cybersecurity graduate programs and cybersecurity research laboratories. The supply of graduates has increased significantly over the last five years but still cannot meet demand; a shortage of qualified experts persists especially in incident response, malware analysis and applied penetration testing. This gap makes outsourcing and investment in training critical. DSET's figure of 1,350 graduates is the concrete output of a 20-year investment aimed precisely at closing this gap.

On the regulatory side, KVKK, BDDK, EPDK, SPK and BTK define different compliance obligations for each sector. The Presidency's Digital Transformation Office (CBDDO) guidance for public institutions consolidated information security management system requirements around TS ISO/IEC 27001. The TSE-ISO compliance certification process of the Turkish Standards Institute has effectively become a precondition in the corporate buyer's vendor selection.

Frequently Asked Questions (FAQ)

My company is small, why would they attack me?

There are two reasons. First, automated scanning. Attackers no longer look at the target; they scan an IP range and find the vulnerable one. Low security = easy target = automated ransom. Second, you may be the supply chain door to a larger organization. If your customer is a holding company, the attacker plans to reach you and pivot from there to your customer.

Is antivirus enough?

No. Classic AV is signature-based, while modern attacks are polymorphic and fileless. EDR/XDR performs behavior analysis and catches behaviors such as process injection, suspicious child processes and registry persistence. Even for an SME it is now a basic requirement.

If I pay the ransomware, will my data come back?

In most cases no, or only partially. The joint CISA and FBI recommendation is not to pay. There is no guarantee that the key will work, in double extortion the data may already have been leaked, and payment makes you a target again for the same group or other groups. Money funds the criminal ecosystem.

If there is a KVKK breach, within how many hours must I notify?

72 hours. Notification to the KVKK Authority and the affected data subject must be made "as soon as possible," with the upper limit interpreted as 72 hours. KVKK Board decisions have applied administrative fines in cases that exceeded this period.

Which incidents must I report to USOM?

Sectors considered critical infrastructure (energy, finance, telecom, healthcare, water, transportation, critical public services) are required to report serious incidents within a short time. The notification form and category details are available on the official USOM page.

What are the three most critical measures?

  1. MFA on all accounts (especially email and admin panels).
  2. Offline and immutable backups (ransomware-proof).
  3. Regular phishing simulation and training.

These three stop or minimize the damage of the overwhelming majority of breaches.

Should I get cyber insurance?

Yes, but read the policy carefully. Ransomware payment is excluded in some policies. The war and state-backed actor exclusion (war exclusion) kicks in under some scopes. KVKK administrative fine coverage varies by policy. It is essential to discuss the details with a broker.

How do I know if I have been attacked?

Typical indicators: unexpected network traffic (especially large data exfil abroad), creation of a new admin account, log deletion or the log service stopping, brute force over RDP and SSH, VPN activity at unusual hours, unexpected scheduled tasks, the antivirus service being "accidentally" stopped, a new service account in Active Directory. A single indicator is not enough, but a combination is a strong sign.

Working with DSET

DSET, since 2003, Ankara Hacettepe Teknokent Beytepe, is one of the firms at the center of Turkey's homegrown cybersecurity ecosystem, with 20 years of cybersecurity experience, an academic legacy of 1,350 graduates, a portfolio of over 100 corporate clients, and a 20,000 TB data management infrastructure.

It provides end-to-end services in penetration testing, digital forensics, incident response, SOC setup, KVKK compliance consulting and training. It uses ISO/IEC 27037 and KVKK-compliant forensic examination processes and an ISO/IEC 27001-referenced management system approach.

DSET's differentiator is the KAOS homegrown AI security engine. Developed in Turkey, running locally, with no cloud dependency, and a MITRE ATT&CK-based multi-expert agent architecture. It is suitable for use on both the offensive side (penetration testing automation, exploit validation) and the defensive side (anomaly detection, threat hunting).

If you would like to talk about a penetration test, a KVKK compliance project, an incident response exercise, or AI-assisted security engine integration for your organization:

Address: Hacettepe Teknokent, Beytepe, Ankara Phone (24/7 emergency response): +90 536 662 38 09 Web: dset.com.tr

Cybersecurity is not a product but a process. When managed with the right team, the right process and the right tools, it ensures that it is the attacker, not your organization, who loses sleep at night.

Sources: