Cyber Incident Victim: Ministry of Education of Armenia
Date:
Jan 2014
Location:
Armenia
Summary
A group of Azerbaijani hackers known as the Anti-Armenia Team breached multiple Armenian government websites, including the Ministry of Education, police portals, city district platforms, educational institutions, and sports organizations. The attackers defaced 64 sites with an anti-Armenian video message, though no confirmation exists regarding stolen sensitive data. This incident followed prior cyber operations by the same group against Armenian government targets, reflecting ongoing tensions linked to the Nagorno-Karabakh conflict. All affected websites were restored to normal operation shortly after the attack.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 21, 2014, hackers identifying themselves as the Anti-Armenia Team, operating from Azerbaijan, executed a coordinated cyberattack against 64 Armenian websites. The attackers compromised multiple Armenian government ministries, including the Ministry of Education, as well as police departments, city district portals, Artsakh State University, the "Youth For Achievements" Educational NGO, and the Football Federation of Armenia. The hackers replaced legitimate website content with defacement pages displaying anti-Armenian propaganda, accompanied by a video message denouncing Armenia. While the group claimed responsibility via email correspondence with journalists, no evidence confirmed whether sensitive data was exfiltrated during the breach. The attack represented a significant escalation in scale compared to previous incidents, targeting critical government and educational infrastructure simultaneously. All affected websites remained offline for approximately two days before restoration efforts commenced.
This incident followed a pattern of cyber aggression linked to the ongoing Armenia-Azerbaijan conflict over Nagorno-Karabakh. The same hacking group had previously breached Armenia’s National Security Service in 2013, leaking classified documents, and had defaced other Armenian ministry websites in August 2013. The 2014 attack leveraged known geopolitical tensions as motivation, explicitly framing the defacements as a political statement. By January 23, 2014, all compromised websites were fully restored to operational status with original content reinstated. No technical details regarding attack vectors or defensive measures taken during restoration were disclosed publicly. The incident underscored persistent vulnerabilities in Armenian governmental web assets and the recurrent targeting of civilian institutions amid regional hostilities.