Cyber Incident Victim: Permanent Mission of the United Nations
Date:
Jan 2016
Location:
Armenia
Summary
Azerbaijani hackers conducted a cyber attack against Armenian government websites, including the Permanent Mission to the United Nations, in retaliation for prior breaches by Armenian hacking groups. The attackers defaced the sites with propaganda content showcasing Azerbaijan's military capabilities, following an ongoing digital conflict rooted in the Nagorno-Karabakh territorial dispute. This incident occurred amid heightened tensions between the two nations, which lack diplomatic relations and remain technically at war.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 4 motives | 6 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 2 actors | Available to members | Available to members |
Description
On January 21, 2016, Azerbaijani hackers operating under the name "Anti-Armenia Team" executed a coordinated cyber attack against Armenian diplomatic websites across 40 countries. The attack specifically targeted the Permanent Mission of Armenia to NATO, the Permanent Mission to the Organization for Security and Co-operation in Europe (OSCE), and the Permanent Mission to the United Nations. Hackers compromised these sites and replaced their content with defacement pages displaying propaganda materials, including text and video messages emphasizing Azerbaijan’s military capabilities. One defacement page featured footage of Azerbaijan’s Prime Minister addressing the nation. The group published Zone-H mirror links as proof of compromise, confirming the unauthorized access to these government-affiliated domains. This operation occurred three days prior to public reporting on January 24 and represented a direct retaliation against Armenian hacker group Monte Melkonian Cyber Army (MMCA), which had leaked sensitive data from Azerbaijan’s Ministry servers the preceding month.
The attackers framed their actions as a continuation of a cyber conflict dating to July 26, 2014, when they previously compromised the official website of Armenia’s president and multiple ministerial platforms. In communications with media, the Anti-Armenia Team asserted that Armenian cybersecurity professionals had repeatedly acknowledged insufficient defensive capabilities against their operations. The incident occurred against the backdrop of unresolved hostilities between Azerbaijan and Armenia stemming from the Nagorno-Karabakh territorial dispute, with both nations maintaining no formal diplomatic relations. No technical details regarding intrusion methods, victim remediation efforts, or operational disruptions beyond the defacements were disclosed in available reporting. The attackers exclusively emphasized psychological and symbolic impacts through the dissemination of nationalist content rather than data theft or infrastructure destruction.