Azerbaijan

This page covers cyber threats to Azerbaijan. It brings together official Azerbaijani statements (the State Service for Special Communication and Information Security, the Ministry of Internal Affairs, the Central Bank, the Ministry of Digital Development and Transport, the Parliamentary Commission on Foreign Interference and Hybrid Threats and the Presidential strategy), a US advisory from CISA, the FBI and DC3, and Brandefense research. Where an official source names Azerbaijan as a target, the page says who said it and when.

Threat groups that official sources link to Azerbaijan

Each group below with a link has a profile in our threat group library. Attribution is stated as given by the named body.

APT29: on 2 May 2025 Ramid Namazov, chairman of the Parliamentary Commission on Foreign Interference and Hybrid Threats, said the cyberattacks on Azerbaijani media outlets were attributed to APT29, described as a Russian-linked cyber espionage group. He said the group had been inside certain media platforms for two to three years before the attack of 20 February 2025. Sources differ on the Russian service: the Kyiv Independent wrote that APT29 is widely believed to be linked to Russia’s Foreign Intelligence Service, while Ukrainska Pravda wrote that it is linked to Russian military intelligence.

Pioneer Kitten: the advisory AA24-241A, released on 28 August 2024 by CISA, the FBI and DC3, lists Azerbaijan among the countries where an Iran-based group has exploited organizations. It says the group’s activity includes intrusions that enable theft of sensitive technical data against organizations in Israel and Azerbaijan, and that FBI analysis is consistent with Iranian state sponsorship. We do not yet have a profile page for this group.

Incidents on record

The incidents below are the major ones only: those with national impact or wide coverage. Smaller attacks are left out.

How attackers target Azerbaijan: Brandefense research

This section summarizes only what our own posts say about Azerbaijan. Our Azerbaijan Threat Landscape Report, dated 23 May 2025, covers threats from 2024 to early 2025. It is based on open-source intelligence, public threat reports and observed incident data, and it says attribution may change as new data emerges.

State-linked. The report names APT29 for an attack on Azerbaijani media outlets and Pioneer Kitten for espionage against government and energy networks. It dates the APT29 media attack to February 2024, while the parliamentary commission dated the media attack to 20 February 2025, so sources differ on the date. The report also describes a February 2025 hybrid attack that it attributes to unknown, likely state-linked actors. Our BugSleep backdoor analysis says investigations suggest MuddyWater, which it places under the Iranian intelligence service MOIS, may be targeting countries such as Turkey, Azerbaijan, Jordan, Saudi Arabia and Israel. Our Fancy Bear profile says APT28 ran phishing attacks in early 2017 against NATO member states, including Turkey and Azerbaijan, and Ukraine. The Mythic Leopard profile lists Azerbaijan among the countries whose critical systems the group targeted.

Government, energy, telecoms and finance. The report counts over 260 threats against government in January and February 2025, a 42% rise on a year earlier. It says a fake domain, govaz.am, was used in spear-phishing and that more than 130 employees across 32 institutions were compromised. For energy, it says at least one company reported data exfiltration attempts believed to be linked to Iranian operators, and that attackers exploited unpatched VPN infrastructure. For telecoms, it says more than 50,000 DDoS attempts hit major providers in late 2024. For finance, it says fraudulent SMS campaigns impersonating banks surged in mid-2024 and led to account takeovers, and that in Q3 2024 a major private bank reported unauthorized transfers linked to session hijacking via mobile.

Hacktivists, banking malware and ransomware. The report says hacktivists from both sides of the Armenia-Azerbaijan conflict carried out defacements and leaks, and that actors moved from basic defacements to hybrid operations. It says cybercriminals aimed banking malware and ransomware at Azerbaijani users, and that thousands of Azerbaijani email and password combinations appeared in dark web data dumps. It lists unpatched systems (Citrix, F5), weak segmentation and poor credential practices as observed weaknesses. Our Medusa ransomware analysis says Medusa and its affiliates do not attack CIS countries, and lists Azerbaijan among them.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Presidential strategy on information security and cybersecurity for 2023 to 2027 was approved by decree on 28 August 2023. It calls itself the first such strategy in Azerbaijan. It rests on the laws On National Security and On Information, Informatisation and Protection of Information. It aims, among other things, to secure state and private networks and critical information infrastructure, and to strengthen the protection of personal data. Presidential Decree No. 1315 of 17 April 2021 covers measures on the security of critical information infrastructure. In the strategy’s own words, Azerbaijan placed 40th among 194 countries in the 2020 Global Cybersecurity Index, with 89.31 points.

How incident response is organized

The strategy names two main bodies. The Electronic Security Service under the Ministry of Digital Development and Transport acts as the national CERT, a coordinating body that detects cyber incidents and takes preventive steps. The Special Communication and Information Security State Service (SCIS), created by Presidential Decree No. 957 of 16 March 2020, runs the government CERT, which protects state bodies and operates a 24/7 Security Operations Center. CERT.AZ runs a hotline on 1654. SCIS reports regular statistics on attacks on state bodies. For the first half of 2025 it said 95 employees of 47 state institutions became victims of hacker attacks and 6,164 citizens fell victim to cyberattacks while using government services. For 2024 it reported 134 employees of 32 state institutions and 3,798 leaked accounts tied to state electronic services.

Sectors and rating

The Ministry of Internal Affairs said over AZN 22 million was stolen from citizens in 16,804 cases of cyber interference in 2024. The Central Bank published digital fraud statistics for the first half of 2025 and set up a working group with the Ministry of Internal Affairs and banks on 16 May 2025. A DDoS attack on the backbone operator Delta Telekom on 21 August 2025 slowed internet services, according to the Ministry of Digital Development and Transport.

The official sources opened give no overall attack counts for the whole country beyond the SCIS figures above. Figures for Azerbaijan will come from Brandefense Atlas.