As the parliamentary elections in Armenia approach in June 2026, various hybrid attacks in the digital domain are becoming increasingly prominent.
Two supposedly rival hacking groups, Armenian Code and Wolves of Turan, have emerged on Telegram, engaging in a performative “tit-for-tat” conflict. However, open-source intelligence (OSINT) analysis suggests this is a single, coordinated campaign aimed at destabilizing the region. The two rivaling hacking teams appear to be backed by the same unknown group responsible for external attacks, with members likely speaking Russian rather than Armenian or Turkish.
Digital twins: born from one source
While these groups claim to represent opposing nationalist interests, their infrastructure indicates a synchronized emergence:
- Coordinated Launch: The Armenian Code (AC) was established on January 14, 2026. Just five days later, on January 19, the rival group, Wolves of Turan (WoT), was created. AC has Telegram channels in English (@armeniancode_eng) and Armenian (@armeniancode_am), while WoT’s channels are in English (@Wolves_of_Turan_eng) and Turkish (@Wolves_of_Turan).
- Infrastructure Mirroring: Both groups registered their channels on the Russian analytical platform TGStat within 24 hours of each other.
Armenian Code-ը TGStat-ում
Wolves of Turan on TGStat
- Visual and structural identity: Both groups appear to be identical twins, mirroring each other’s posts.
Hacking teams often use third-party websites to provide objective proof of their successful attacks. For each attack, a unique link is created to verify that the website was targeted at the specific time. Notably, both Armenian Code and Wolves of Turan employ the same website for this purpose, which is intriguing. However, an even more intriguing incident has been documented, suggesting that the same person manages both Telegram channels. On one occasion, the common admin accidentally posted the same links on both “rivaling” channels, exposing their affinity.
check-host.net/check-report/3d35ec43kb85
check-host.net/check-report/3d35ee5dk6e6
check-host.net/check-report/3d35ed41kc29
In this case, those who engaged in manipulation have become victims of their own actions, inadvertently posting the same links.
Linguistic fingerprints: the “Russian” syntax
While they present themselves as Armenian and Turkish patriots, linguistic analysis by multiple language models (Gemini, ChatGPT, Grok) has revealed significant markers of Russian-language thought patterns in their English content.
- Translation Artifacts: The groups use specific calques (word-for-word translations) common in Russian political discourse but rare in native Armenian or Turkish digital culture.
- Calques from Russian: Literal, slightly awkward English idioms that strongly suggest translation from Russian: “sit idly by with folded arms”, “absorbed it with our mothers’ milk”, “piece by piece”, “we will not miss a single attack, and we will take revenge!”, “The call of blood”.
- Cyrillic Artifacts: In the AC post, it mentions the opposition party “Hayk” (Аякве). The presence of the Cyrillic spelling Аякве alongside the name strongly suggests that the original draft was written in a Cyrillic-based script, likely Russian. This is particularly notable because “Hayk” is an Armenian name, yet the transliteration provided follows Russian phonetics. Additionally, the correct name of the political party is Hayaqve, not Hayk. This discrepancy indicates that the translation may have been generated automatically, with the operator not delving into the details.
Target: sabotaging Armenia
The primary objective of this operation appears to be establishing a basis for cyber-interrogations targeting Armenian infrastructure under a foreign flag.
In April 2026, the operation evolved from an information war between two hacking teams into high-impact DDoS and SCADA cyber-attacks.
According to their statement, the Wolves of Turan initiated significant attacks against Armenia’s financial, governmental, and other critical infrastructure in retaliation for the Armenia Code team’s attacks on Turkish and Azerbaijani targets. It is likely that more large-scale attacks will occur in the coming weeks.
Conclusion: a manufactured crisis
The “Armenian Code” and the “Wolves of Turan” are not adversaries; they are the two hands of one body. By orchestrating a “cyberwar,” the threat actor achieves several geopolitical objectives through a false-flag operation:
- Economic Disruption: Undermining trust in the stability of Armenian banking, fintech, state institutions, and security organizations.
- Political Polarization: The operation aims to escalate the Armenia–Turkey/Azerbaijan conflict, whether through cyber warfare or more broadly, just before the June elections.
