Cyber Incident Victim: Embassy of Armenia in Greece
Date:
Jan 2016
Location:
Armenia
Summary
Azerbaijani hackers defaced the websites of Armenia’s diplomatic missions to NATO, the OSCE and the United Nations, as well as embassy sites in roughly forty countries, replacing them with a page that displayed Azerbaijani military imagery and messages. The attackers said the action was a response to prior Armenian cyber operations and highlighted the lack of bilateral diplomatic relations due to the ongoing Nagorno‑Karabakh conflict and underscored the broader cyber tension between the two nations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
The incident was reported on January 24, 2016, noting that the defacement occurred three days earlier, around January 21, 2016. Azerbaijani hackers, identified as the Anti‑Armenia Team, compromised the official website of the Permanent Mission of Armenia to NATO. They also defaced the Permanent Mission of Armenia to the Organization for Security and Co‑operation in Europe (OSCE). The Permanent Mission of Armenia to the United Nations was similarly targeted. In addition, embassy and related websites of Armenia in approximately forty countries were altered. The attackers replaced the normal content with a defacement page that featured Azerbaijan’s prime minister addressing the nation, accompanied by text and video messages showcasing Azerbaijani military power. In an interview with HackRead, the hackers claimed responsibility for the operation and described it as a reply to Armenian hacking activities. They referenced a prior attack on July 26, 2014, in which the Anti‑Armenia Team had destroyed the official website of the Armenian president and several government ministries.
The defaced pages remained visible until the sites were restored, and the hackers provided zone‑host mirrors of the altered pages as proof of the compromise. The incident was framed within the broader cyber conflict between the Azerbaijani Anti‑Armenia Team and the Armenian Monte Melkonian Cyber Army (MMCA). Both sides have engaged in reciprocal website defacements and data leaks amid the ongoing Nagorno‑Karabakh dispute, which leaves Armenia and Azerbaijan without diplomatic relations and technically still at war. The hackers stated that their action was intended to counter Armenian cyber operations and to demonstrate Azerbaijan’s capabilities. No further details about detection, containment, or remediation efforts were disclosed in the source material.