Cyber Incident Victim: Armenia
Date:
Jun 2014
Location:
Armenia
Summary
The Armenian President's website and several government ministry sites were defaced by Azerbaijani hackers from the Anti‑Armenian Team, who posted a deface page accompanied by a video message featuring a speech from Azerbaijan’s Commander in chief of Armed Forces Ilham Aliyev and text asserting that Karabakh belongs to Azerbaijan and accusing Armenian forces of occupying Azerbaijani territory. The hackers also left a written statement referencing UN resolutions and claimed the action was timed to coincide with Azerbaijan’s Armed Forces Day. This was not the first operation by the group, as they had previously breached the Armenian national security service and leaked classified documents. Although the compromised sites were restored shortly after the attack, the Google cache of the site continued to display the deface page at the time the article was published.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On 26 June 2014, Azerbaijani hackers affiliated with the Anti‑Armenian Team compromised the official website of the President of Armenia and several government ministry sites. The intrusion occurred on the day commemorating the Armed Forces of Azerbaijan. The attackers gained unauthorized access and replaced the normal content with a defacement page. This defacement included a video message featuring a speech by Ilham Aliyev, the Commander‑in‑Chief of the Azerbaijani Armed Forces.
Accompanying the video was a textual statement that began with a patriotic address to the Azerbaijani military and proceeded to assert Azerbaijan’s claim over the Nagorno‑Karabakh region. The text alleged that Armenian armed forces occupied twenty percent of Azerbaijan’s territory and referenced four United Nations resolutions calling for the withdrawal of those forces. The same message was replicated across all defaced government sites.
By the time the article was published on 28 June 2014, the Armenian authorities had restored the compromised websites to their original state. Nevertheless, the Google cache of the Armenian Presidential site continued to display the defacement page, preserving the attackers’ message in search results. The article also notes that this was not the first operation by the Anti‑Armenian Team against Armenian governmental targets, citing a prior breach of the Armenian National Security Service that resulted in the leak of classified documents.