A.S.A.L.A.

Profile narrative

The threat actor is known by the aliases A.S.A.L.A. and Noyer_1K and is associated with the Armenian Monte Melkonian Cyber Army. Open‑source reporting indicates the group operates from Armenia, although no definitive state sponsorship has been publicly attributed. The actor has been linked to a series of cyber operations that target Azerbaijani governmental and financial entities, reflecting the broader Nagorno‑Karabakh conflict between the two nations.

Typical targets include Azerbaijani diplomatic missions, government portals, military and police databases, and banking systems. The actor’s stated objectives, as expressed in the compromised communications, involve retaliation for Armenian independence commemorations and asserting symbolic leverage in the ongoing territorial dispute. Observed tactics consist of website defacement, exfiltration of personal and financial data, and public leakage of the stolen information to validate the breach’s authenticity; no specific malware families, initial access vectors, or custom tooling are described in the available sources.

Attribution to the group rests on public claims made by the actors themselves and the consistent use of the A.S.A.L.A. moniker across incidents. No explicit connection to a state apparatus or criminal consortium has been documented in the reporting. Representative campaigns include the September 2016 defacement and data leak of multiple Azerbaijani embassies and government sites, and the November 2015 breach of the Azerbaijan Central Bank’s Mortgage Fund sub‑domain, which resulted in the theft of customer credentials and administrative data. These operations illustrate a pattern of politically motivated cyber activity focused on information disclosure and service disruption rather than financial gain.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 1 source.