Key Cypriot Infrastructure Under Attack by Turkish Hackers

• The Cypriot state accuses a specific Turkish actor of launching a wave of attacks against critical infrastructure.
• The scope of the attacks includes ministries, the Larnaca airport, and more recently, the parliament website.
• The country has a long way to go still when it comes to securing state services and online portals.

The Cypriot authorities are reporting that key infrastructure is currently being targeted by Turkish hackers, who have had moderate success. According to the details given by state sources on the Cyprus News Agency, the attacking spree started last week with an unsuccessful attack against the Defense Ministry’s website. Yesterday, there were reports about the hackers focusing their efforts against a server used by the Larnaca airport. And today, local media outlets report that the parliament website is under attack.

This has created a serious disruption in the Parliament’s functions, as today was the day when a list of loans given to 22 politically exposed persons would be published on the site. Naturally, some people in the island-nation found the timing suspicious, but the authorities promised to publish the documents as soon as they can update the website.

The details shared with the public claim that the attack method is the same used in the previous cases, but what this constitutes exactly remains a mystery. Judging from the actors’ moderate success rates and the fact that the websites remain up and running, this doesn’t seem to be a ransomware incident.

In the case of the Larnaca airport server, the Digital Security Authority and the Commissioner for Personal Data Protection were both informed of the incident, so there may have been signs of data access and exfiltration, even if the attack was reportedly thwarted. For Cyprus, airport operation is crucial, considering this country is relying heavily on tourism. The Larnaca airport is the largest on the island, so it’s a neuralgic target that has to be safeguarded against hackers.

Back in September 2020, the undersecretary of the Cypriot Ministry of Research, Innovation, and Digital Governance Kirakos Kokkinos told the press that the state services are, in essence, left unprotected against any form of cyber-attack. As he characteristically stated: “Rating Cyprus on the issue of cybersecurity, today, we are at zero.”

Kokkinos estimated that Cyprus would need at least two years to form a team that would develop an adequately effective protection umbrella. Considering that statement and the current wave of attacks, Cyprus could still be severely exposed to a wide range of cyber-risks.