A self-described nationalist Turkish hacker group which calls itself Alsancak Tim has hacked the majority of Ghana’s government websites, including its main site.
The websites, which are now offline, were defaced with a message indicating the websites had been hacked by Alsancak Tim. The message also said “EFELER” and “SPECIAL OPERATIONS” below the text which indicated that the website was hacked by Tim.
A total of 11 Ghanian government websites were hacked by the Turkish hackers, according to a Facebook post from the AlsancakTim Facebook account. The Facebook post also included links to the hacked websites as well as links to mirrors of the hacked sites hosted on defacement archives such as Zone-H.
A Zone-H user by the name of “VirtuaL” notified the website, which archives defaced websites, of the hack. The user has hacked and defaced other government websites such as select sites in Sri Lanka as well as the United States. The archived page for ghana.gov.gh domain on Zone-H indicates that the government website was hosted on an Apache web-server running on the Linux operating system. The mirror was saved on 2015-01-21 00:43:16, according to the defacement archive.
The defacement mirror for www.veterans.idaho.gov shows a graphic which indicates that the website was hacked by a group calling itself TURKİSH CYBER ARMY. The group claims to be composed of five members which operate under the handles (online aliases) of VirtuaL, DARKWAR2, Bordobereli, Maress, and DOGU_KAN.
VirtuaL had a total of 516 notifications for defaced websites on Zone-H, 470 of which were listed as mass defacements. The mass hacks explains why the 516 hacked websites were hosted across 46 IP addresses, as many of the websites were hosted on the same servers.
The country’s deputy communications minister indicated that experts were working on restoring the websites and investigating who was behind the hack, BBC reported. The communications minister also indicated that the websites are to be restored by the end of the day.
After the hack, the website which serves as the official portal for the Government of Ghana had a message which read:
The site is currently under maintenance. Please come back soon!
Another user on Zone-H, DARKWAR2, notified the defacement archive site of the nss.gov.gh hack. DARKWAR2 was listed as a member of the Turkish Cyber Army hacking group.
Who do you think is behind the hack and why do you think they did it?