The media in Armenia have been the target of cyber attacks for years. Since the beginning of the 2000s, media outlets have been hacked by Azerbaijani groups.
Until the 2010s, Turkish hacker groups also carried out active attacks, mainly conditioning them on Genocide-related topics: every April 24 or in any country in parallel with raising the topic of Genocide recognition.
The situation became much more serious in the 2010s, as hacker teams were formed in Azerbaijan, working mainly in the direction of Armenia.
Those teams had two target groups: state websites and media.
In 2012, Ramil Safarov’s extradition from Hungary was followed by a large-scale hacker attack against Armenia following a diplomatic and propaganda conflict between Yerevan and Baku. During the attack, not only were traditional sites attacked, but large-scale DDoS attacks were used.
This, as well as the number of subsequent DDoS attacks, suggests that the attacks were state-sponsored. This time the primary target was the media, which was followed by attacks on state websites.
New bad traditions were set before the same 2012 elections: The first internal political hacker attacks were used. Since then, the media has been the target of DDoS attacks. However, internal political attacks have peculiarities that make the attacks difficult to study.
Some of these attacks are simply not voiced due to various internal political and economic considerations.
The other part, presumably, does not correspond to reality and is used by the editorial offices for political manipulations or PR. Cases of numerous attacks have not been investigated, have not been confirmed by independent experts.
And the existing cases did not lead to revelations, which will allow for drawing any conclusions.
The analysis is mainly done at the level of assumptions, the principle is old and simple cui prodest. Moreover, there is a possibility that domestic political attacks may be disguised under attacks by Azerbaijani hacker teams, as they are the main and most common option.
Armenia, as well as the Armenian press, was subjected to the most serious attacks in 2020. During the July Tavush events and the Artsakh war, the press was one of the main targets.
News sites are usually attacked by DDoS from the moment hostilities begin. This is already a rule, which started to be formed after the above-mentioned events of 2012. And it is a consequence of 2012 and the events that followed that most of the Armenian media already use defense systems, mainly Cloudflare.
In any case, the connection of the defense system does not solve the problem on its own: The attackers use different tricks and professional intervention is needed.
In the case of the Artsakh war, DDoS attacks were carried out by the Azerbaijani side on a continuous basis. Almost all Armenian media outlets were under attack. Moreover, the attacks were carried out with constant changes of directions, which also required constant attention and intervention from the point of view of defense.
For example, the Azerbaijani Academy of Sciences was working against Armenian websites (Photo from Arthur Papyan’s Twitter):
Ruben Muradyan reported that the media was urged by the government to simply block entry from Azerbaijan and Turkey.
I’ve got a few reports, that @armgov is calling media, asking them to block user IPs from AZ and TR, effectively limiting Armenian propaganda to AZ and TR users. It is neither correct, nor efficient. Dear @armgov, we need to push our PoV to them, not block it. #ArtsakhStrong
— Ruben Muradyan (@RubenMuradyan) September 27, 2020
However, blocking Azerbaijani and Turkish IP addresses completely is not the right solution, as there is a sharp increase in the number of real users turning to Armenian media at such times. In addition, hackers are actively using VPN, TOR traffic to disguise attacks coming from the Azerbaijani sector.
There are also many attacks, the meaning of which is to post either false information or propaganda material on the website.
Thus, the attack on Cloudflare accounts during the war led to the redirection of visitors to a number of popular media outlets. And dozens of websites were hacked at the same time: some simply as a result of a direct attack.
In fact, on September 27, the main part of the Armenian press was closed for a short time. The following sites were listed, for example:
In general, dozens of Armenian news websites have been hacked during the last ten years. Most of them were targeted by Azerbaijani and Turkish hacker groups.
Journalists are also targeted. Again, the main recorded cases are related to Azerbaijani hackers. However, most of the cases speak about the fact that the journalists are not a separate target. Hackers carry out mass phishing attacks, in which journalists are also victims.
However, cases of targeted attacks are also known. Most of them are not made public, which makes it impossible to have accurate statistics.
Thus, at the end of 2020, the report “Russia hackers pursued Putin foes, not just US Democrats” appeared, this time it was published by the Associated Press. And again, this would mean that you have to spend on these processes. And it becomes clear again that in the list of large-scale cyber attacks, which was carried out in the territory of a large number of countries at once, there are also Armenians.
According to the presented quantitative list, there were 41 targets from Armenia.
“Russia hackers pursued Putin foes, not just US Democrats” report
The list of Armenian victims of the attacks has not been published, it is only known that in 2015, during the protests in Electric Yerevan, EVN Report editor Maria Titizian was attacked.
According to our data, among those 41 people, there are journalists, as well as political scientists and analysts, all of whom can be described as more pro-Western.
Internal data known to CyberHUB-AM, allow us to say that the targeted attacks on Armenian journalists and media outlets, of course, are not mass, but they are much larger than it is made public.
And there are more and more cases when one can suspect state-sponsored groups.
The increase in the activity of internal political attacks is also obvious.
Samvel Martirosyan
The views expressed in the column are those of the author's and do not necessarily reflect the views of Media.am.
Add new comment
Comments by Media.am readers become public after moderation. We urge our readers not to leave anonymous comments. It’s always nice to know with whom one is speaking.
We do not publish comments that contain profanities, non-normative lexicon, personal attacks or threats. We do not publish comments that spread hate.