Skip to content
CTI Academy Sponsor CTI Academy
TR

Ransomware attacks in Turkey

174 organisations in Turkey have been listed on ransomware leak sites, ranking #18 worldwide. Updated .

Victims
174
0.7% of global total
Global rank
#18
of 181 countries
Active groups
49
Most: Qilin
Sectors
19
Most: Manufacturing

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Turkey. Figures are computed from the tracked records, not inferred.

With ransomware activity recorded against Turkey for 172 victims globally ranked 19th, key groups such as Qilin, Nightspire and Thegentlemen target sectors including manufacturing, technology and healthcare.

Turkey in the global picture

Turkey accounts for 174 of the ransomware disclosures tracked here, ranking #18 worldwide and making up 0.7% of the global total. The sectors listed most often are Manufacturing, Technology, Healthcare.

Who is most active in Turkey

Qilin — 31 victims in Turkey. Qilin ransomware was first observed in July of 2022. Nightspire — 14 victims in Turkey. Thegentlemen — 11 victims in Turkey.

Where to report an incident in Turkey

National computer emergency response teams for Turkey, as registered with ENISA and the teams themselves. Regional, sectoral and vendor response teams are excluded; verify current contact details before relying on them in an incident.

Ransomware threat profile: Turkey

Turkey ranks #18 worldwide for ransomware disclosures, with 174 victims in this database — 0.7% of the global total. The groups listing the most organisations here are Qilin, Nightspire and Thegentlemen.

The most frequently listed industries in Turkey are Manufacturing, Technology, Healthcare. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Turkey's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Turkey 174

Page 1 of 2
Organization Disclosed
Kale Balata A
Qilin
istanbultrading.com
Lockbit5
merkezilac_archives
Hyflock
Asyaport (container terminal operations)
N0n
MGT Lojistik AŞ
Nightspire
Grand Ion Delemen Hotel
Majinahanashi
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi
Qilin
ENKA Schools
Doommageddon
ENKA Schools
Doommageddon
OMUR HIRDAVAT LTD
Emperador
Polikem
Emperador
Polikem
Emperador
acilnet.com
Krybit
Zorlu Holding
Qilin
Zorlu Holding
Qilin
AstraZeneca Türkiye
N0n
www.harputyapi.com
Krybit
www.harputyapi.com
Krybit
Cumar Marble & Granite
Dark project
Cumar Marble & Granite
Dark project
i2i-systems
Barracuda
Ozel & Ozel Laws Office
Nightspire
Ozel & Ozel Laws Office
Nightspire
Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco...
Blacknevas
Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco...
Blacknevas
Yapı Merkezi
Thegentlemen
Yapı Merkezi
Thegentlemen
Uak University
Qilin
Uak University
Qilin
Erdem Hospital
Direwolf
Akpera Gayrimenkul Yatırım A.Ş.
Doommageddon
SITTNAK Lojistik A.Ş.
Doommageddon
Global Terminal Services
Deadlock
Tianji Auto Care Service Company
Nightspire
Akuur Law Firm
Qilin
Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach
Blacknevas
A101
Crpxo
ANADOLU SİGORTA
Crpxo
ANADOLUBANK
Crpxo
ASELSAN
Crpxo
DOĞAN HOLDİNG
Crpxo
FINANSBANK
Crpxo
KUVEYT TURK
Crpxo
THY
Crpxo
Db Tarimsal Enerji
Qilin
AHENK lab
Deadlock
MKS Transformator
Nightspire
iw steelTEC Makine San. ve Tic. A.Ş.
Doommageddon
HİDROMEK
Deadlock
Assos Pharmaceuticals
Qilin
meralmanisa
Nova
meralmanisa
Nova
Synergy Products
Qilin
Synergy Products
Qilin
degeremcia.com
Dragonforce
Güven Mühendislik Makina
Deadlock
Maxplast AND Senoco
Deadlock
KOLORKIM KIMYA
Doommageddon
Mercedes-Benz Turk
Doommageddon
aydeniz.com
Apt73
Arkin Group
Blacknevas
Software Arge
Payload
parampackaging.com
Lockbit5
Makel Companies Group
Qilin
Can Healthcare Group
Qilin
SECiL
Deadlock
Cekok
Dragonforce
Oztugotomotiv
Incransom
Adensa Teknoloji
Nova
Caka Grup Lojistik
Thegentlemen
Emek Elektrik
Bravox
Mopas Online Supermarket
Auditteam
tkgm.gov.tr
Apt73
TAKOSAN OTOMOBIL
Nightspire
Arcelik
Thegentlemen
Kınık Gross
Thegentlemen
gursoygrup.com.tr
Lockbit5
The company MST (Sanko Makina and ASKO Holding)
Blacknevas
banak.com
Apt73
Narteks Tekstil A.S
Krybit
Kolin Turkey
Qilin
Limkon
Qilin
palladium.gen.tr
Krybit
Sadtek
Qilin
PARS AR-GE
Nightspire
TTAF Defense
Nightspire
Teknopres_TR
Incransom
AKOL LAW
Nightspire
NEW GENERATION MEDIA
Dragonforce
Tenteks Tente
Dragonforce
Öztekin Group
Dragonforce
Akkök Holding
Qilin
Zabun
Thegentlemen
Betesan
Dragonforce
A1 Capital
Dragonforce
Erg Otoyol
Thegentlemen
Ankara-İzmir
Thegentlemen
Kopas Cosmetics
Qilin
Şemsioğlu Uşak Ev Tarhanası
Qilin
KAZMILAW.COM
Clop

Frequently asked questions

How many ransomware attacks have occurred in Turkey?

Turkey has recorded 174 ransomware victim disclosures in this database, ranking #18 globally. This represents 0.7% of all tracked ransomware attacks worldwide.

Which ransomware groups target Turkey?

The ransomware groups most active in Turkey are Qilin, Nightspire, Thegentlemen, Lockbit5. These groups collectively account for the majority of victim disclosures attributed to Turkey.

Which industries are most targeted by ransomware in Turkey?

In Turkey, the most frequently targeted sectors are Manufacturing, Technology, Healthcare. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Turkey rank globally for ransomware attacks?

Turkey ranks #18 globally for ransomware attacks with 174 victim disclosures, representing 0.7% of the worldwide total of 23,662 tracked victims.

How can organisations in Turkey protect against ransomware?

Organisations in Turkey should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Turkey is also recommended.