Cyber Incident Victim: Consulate of Armenia in Batumi, Georgia
Date:
Jan 2016
Location:
Azerbaijan
Summary
Azerbaijani hackers affiliated with the Anti-Armenia Team conducted a cyberattack targeting Armenian diplomatic and government websites, including the Permanent Mission to NATO, OSCE, and United Nations, as part of an ongoing cyber conflict with Armenian hacking group MMCA. The attackers defaced the sites with propaganda messages and videos emphasizing Azerbaijan's military strength, retaliating against prior MMCA breaches of Azerbaijani government servers. This incident occurred amid heightened tensions due to the unresolved Nagorno-Karabakh territorial dispute, with both nations lacking formal diplomatic relations and remaining technically at war.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On January 21, 2016, Azerbaijani hackers operating under the name "Anti-Armenia Team" executed a coordinated cyber attack against Armenian diplomatic and international mission websites across 40 countries. This offensive targeted the official websites of Armenia's Permanent Mission to NATO, Permanent Mission to the Organization for Security and Co-operation in Europe (OSCE), and Permanent Mission to the United Nations. Attackers replaced legitimate website content with defacement pages displaying propaganda materials, including textual messages and videos emphasizing Azerbaijan's military capabilities. One defacement page featured footage of Azerbaijan's Prime Minister addressing the nation, while others showcased military imagery. The hackers publicly claimed responsibility through communication with media outlets and provided Zone-H mirror links as evidence of successful compromises.
This incident represented an escalation in the ongoing cyber conflict between Azerbaijani and Armenian hacker groups, directly responding to prior actions by the Armenian Monte Melkonian Cyber Army (MMCA). In December 2015, MMCA had breached servers belonging to Azerbaijan's Ministry, exfiltrating and leaking sensitive government data. The Anti-Armenia Team framed their January 2016 website defacements as retaliation for these breaches, while also referencing their July 2014 attack against the Armenian presidential website. The attacks occurred against the backdrop of unresolved hostilities stemming from the Nagorno-Karabakh territorial dispute, with no formal diplomatic relations existing between the two nations. No technical details regarding detection methods, containment procedures, or restoration efforts were disclosed in available reporting. The operational impact consisted of temporary service disruptions to the targeted diplomatic websites and the public dissemination of geopolitical messaging through compromised digital platforms.