Anti-Armenia Team

Profile narrative

The threat actor known as the Anti‑Armenia Team, also referred to as the Anti‑Armenian Team, operates from Azerbaijan. The group describes itself as an independent hacktivist collective that has been active for approximately five years. It has claimed responsibility for a series of cyber operations targeting Armenian governmental and diplomatic entities. Public reporting links the actor to the broader Nagorno‑Karabakh conflict between Armenia and Azerbaijan. No public source attributes the group to a state sponsor or a criminal organization.

The actor’s typical targets include Armenian government ministries, presidential offices, national security services, and diplomatic missions accredited to NATO, the OSCE and the United Nations. In addition to websites, the group has compromised social‑media accounts, exemplified by the takeover of the Russian Embassy’s Twitter account in Armenia. Their stated objectives are to protest perceived Armenian actions, to showcase Azerbaijani military capabilities, and to retaliate against prior cyber operations by Armenian hacking groups. These objectives manifest as espionage‑type data leaks, disruption through site defacement, and political messaging via hijacked accounts. The leaked material has included foreign visitors’ passport scans and internal analytical reports from Armenia’s Security Service.

Observed tactics involve website defacement with propaganda imagery and video messages, the exfiltration of documents allegedly obtained from compromised insiders, and the hijacking of social‑media platforms to disseminate protest content. No specific malware families, exploit kits, or custom tooling are referenced in the available reporting. Attribution remains limited to the actor’s self‑identified Azerbaijani origin; no definitive state nexus or criminal consortium link has been established in open sources. Representative campaigns cited in the literature are the 2016 leak of Armenian National Security Service data, the 2016 coordinated defacement of Armenian diplomatic sites in roughly forty countries, and the 2014 defacement of the Armenian presidential and ministry websites. These operations illustrate the actor’s focus on political disruption and information exposure rather than financial gain.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 5 sources.