Cyber Incident Victim: Azerbaijan Press Agency
Date:
Apr 2016
Location:
Azerbaijan
Summary
A cyber conflict erupted between Turkish and Armenian hacker groups amid heightened tensions over the Nagorno-Karabakh territorial dispute. The Turk Hack Team (THT), aligning with Azerbaijan, launched disruptive attacks targeting multiple Armenian entities, including government portals, financial institutions, and security services, reportedly restricting access to these systems. This offensive followed cyber operations by Armenia's Monte Melkonian Cyber Army (MMCA), which had previously compromised Azerbaijani government servers through defacements and data leaks. Both groups leveraged their capabilities—THT employing DDoS attacks and MMCA focusing on infiltration and information exposure—as retaliation for military clashes and to assert digital dominance in the geopolitical conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
The Nagorno-Karabakh conflict escalated into cyberspace in early April 2016 following deadly clashes between Armenian and Azerbaijani forces that resulted in at least 30 military fatalities. Armenian hacker group Monte Melkonian Cyber Army (MMCA) initiated cyber operations by targeting Azerbaijani government servers on April 1, 2016, successfully shutting them down as a demonstration of capability. This action prompted retaliation from the Turkish hacker collective Turk Hack Team (THT), which publicly declared support for Azerbaijan through a Pastebin statement. THT launched coordinated distributed denial-of-service (DDoS) attacks against multiple Armenian government and financial institutions, including the National Bank of Armenia, National Security Service, Ministry of Energy and Economy, and the central government portal. The attacks disrupted public access to these critical online services, effectively disabling their web presence.
THT's offensive leveraged their established DDoS capabilities, previously demonstrated during attacks on Vatican City websites following Pope Francis' use of the term "genocide" regarding historical Armenian deaths. MMCA maintained operational parity through complementary tactics including server defacements and exfiltration of sensitive data from Azerbaijani systems, though specific compromised datasets weren't detailed in available reports. Both groups framed their actions as direct responses to territorial disputes over Nagorno-Karabakh, with THT explicitly labeling Armenia as the aggressor in their manifesto. The cyber operations caused functional disruptions to governmental and financial services in both nations, though no verifiable data exists regarding duration of outages, economic impact quantification, or subsequent restoration processes. No third-party cybersecurity interventions or official government responses to the attacks were documented in contemporaneous reporting.