R5V0LT
R5V0LT is a Türkiye-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets the Finance, and Hospitality and Tourism sectors in Germany and Türkiye.
- R3V0LT TR
- REVOLT
- Origin
- Türkiye
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Mar 8, 2026
- Last seen
- Jul 26, 2026
- Record updated
Who They Target.
About R5V0LT.
R5V0LT is a Turkish-speaking, financially motivated criminal actor operating primarily through Telegram. The actor advertises or brokers illicit financial and cybercrime services, including money laundering, fraudulent invoicing, bank-account and payment infrastructure, card loading and cash-out, payment-system abuse, illegal-gambling support, stolen-data sales, proxy and escrow services, and the recruitment of financial and technical intermediaries. R5V0LT also claims capabilities related to distributed denial-of-service attacks, website defacement, data leaks, target breaches, doxing, intimidation, and illicit goods. The actor is assessed as likely based in, operating from, or closely connected to Turkey due to its language, domestic operational references, local financial infrastructure, and Turkish-lira transactions. Most capability, access, transaction-volume, and operational-success claims are self-reported and have not been independently corroborated.
Last updated Aug 5, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.