‘The trail leads to Azerbaijan and Israel’: Yerevan’s take on new cyberattacks on Armenia
Cyberattacks on Armenian government agencies
Several Armenian government agencies have come under cyberattack, according to Citizen Lab, a Canadian organisation that researches cybersecurity and digital censorship and works to protect human rights.
Information security expert Samvel Martirosyan said the attacks were targeted rather than random.
The targets included specific individuals and organisations, notably the office of Prime Minister Nikol Pashinyan, the Central Bank and the Central Election Commission.
Investigators have identified the Israeli company Candiru as responsible for the cyberattacks. In 2021, the same company targeted Armenia, infecting computers with malware.
At the time, Candiru acted on behalf of Azerbaijan. Samvel Martirosyan says he cannot determine which country, if any, stands behind the latest cyberattack.
“My guess is that either Azerbaijan, Israel itself, or both countries are behind this. I don’t think any other interested party could afford to buy these services. Carrying out attacks of this kind requires authorisation from the Israeli military,” the expert said.
It remains unclear what data or information the hackers wanted to obtain and what they managed to access in the attacks.
- Leak reveals secret documents on Russia’s hybrid attacks against Armenia
- Hybrid attacks on Armenia by two supposedly rival hacking groups
- ‘Many in Armenia are careless with their personal data’ – expert
Commentary
According to information security expert Samvel Martirosyan, the Canadian organisation Citizen Lab identified attacks similar to those recorded in the past. However, the earlier incidents did not involve exploits that require no user interaction, known as “zero-click” exploits.
He recalls that the Israeli company Candiru has previously carried out cyberattacks against Armenian government agencies.
This time, however, the attackers also infected devices through online advertisements:
“They reached an agreement with an advertising network. Websites often use software from advertising networks to display ads, while the site owners receive a share of the revenue. In this case, a major advertising company effectively partnered with Candiru, using these ads to infect users.”
According to Martirosyan, the attacks targeted Windows computers as well as mobile phones. It remains unclear whether the hackers collected detailed, in-depth data from the phones. However, Martirosyan suspects they may use this information later to carry out “other types” of attacks.
“The attacks were widespread. Most infections occurred through the mamul.am website. Under no circumstances should anyone assume that the website itself had any involvement in what happened. The only issue was that it displayed banners from this advertising network. The ads appeared around one million times, and investigators classified 100,000 of those instances as targeted and malicious. The attackers used them to collect data or launch an attack.”
Martirosyan stressed that Candiru’s cyberattack was not the only incident of its kind in recent days.
Cybersecurity firms Cisco Talos and Recorded Future published a report describing an attack on Armenia by another hacking group.
Based on the group’s tactics, its interactions with other hacking groups and its time zone, the companies investigating cyber threats suspect that the attack originated in Kazakhstan.
“These hackers speak Russian. They may actually be based in Russia, but are trying to disguise their origins by posing as actors operating from Kazakhstan,” the expert said.
According to Samvel Martirosyan, Kazakhstan is an “unusual actor” in cases of this kind. He suspects that “other forces attempting to operate under the flag of Kazakhstan” may be behind the attack. In early 2026, the same hacking group attacked Armenia’s Ministry of Foreign Affairs and Foreign Trade.
However, Armenia is not its only target. The group also operates against targets in Tajikistan, Belarus and Russia.
“These are not sophisticated tools that work on a ‘zero-click’ basis, without user interaction. The hackers use phishing and then try to install malware on computers,” the expert added.
Cyberattacks on Armenian government agencies
