2023 was a year, like the previous few years, during which journalists and media outlets in Armenia were targeted by cybercriminals and various hacking teams. What were the main threats?

First, it should be noted that the state or state-related groups or agencies also worked against the press and journalists.

The primary perpetrators behind the attacks were none other than the Azerbaijani special services. It is worth highlighting that the Pegasus spy program was deployed repeatedly throughout the year for these attacks. Two main points should be emphasized regarding Pegasus infections. Firstly, based on our observations, the special services of Azerbaijan have been continuously targeting the phones of representatives of civil society in Armenia and Artsakh, at least until October 2023. Secondly, the list of victims still includes journalists or individuals associated with the media.

It is worth noting that this year, there have been no confirmed reports of attacks against journalists using the Predator spy program. Two years ago, both Meta and Google confirmed that the Armenian authorities were likely using this spy program, and the list of victims included media-affiliated entities.

During the recent conflict in Artsakh, it was noticed that Azerbaijan did not carry out any significant cyber-attacks, which was unusual. During previous escalations, they had conducted cyber-attacks against state and news websites, but this time, there was almost no such activity.

However, in August, a DDoS attack was launched against the website of the “Hraparak” daily newspaper. No other attacks on websites accompanied this attack. This suggests that Azerbaijan, often suspected of such attacks, was unlikely to be involved this time. It is more likely that an internal source carried out the attack. For more technical details about the incident, refer to the report from the Hexens organization responsible for protecting the website at that time.
 

This year, phishing attacks have been particularly aggressive, targeting news outlets and individuals; the primary channel for the malicious attacks is Facebook. Various styles of emails are being sent to page admins, attempting to extract their passwords. Even worse, some of these emails are now being sent in Armenian via messenger. Here is an example of a recent phishing email:

The diverse range of phishing emails and their stylistic variations often make it difficult for news page administrators to distinguish between genuine requests and fraudulent attempts. As a result, there have been instances where hackers have almost obtained passwords from these administrators. Regrettably, there have been several instances where journalists’ personal accounts have been compromised.

If we look beyond targeted attacks, we can see that one of the biggest problems faced by media is the imposition of sanctions by social networking platforms. These sanctions can range from reduced page visibility to blocking the media’s accounts completely. Sadly, there are still instances where the media’s use of Monte Melkonyan’s name or image leads to their accounts being blocked on Facebook and Instagram. You can read more about the issue here. The problem is so severe that there have been instances where a media page was penalized just because a poster with Monte’s photo was seen in the background of a video.

Specific topics, such as posts related to the Israeli-Palestinian conflict or health issues, can also result in sanctions. These penalties can occur for unreasonable or even surreal reasons.

Regardless of the circumstances, journalists and media outlets are equally vulnerable to targeted cyber-attacks. They can also fall prey to the general waves of cyber-attacks and mindless social media moderation.

Samvel Martirosyan