Glossary term
Cyber espionage
Cyber espionage is the use of computer networks to secretly gather information that someone wants to keep private.
Read more
Significant cyber incident
Cyberattacks on Azerbaijani media outlets, February 2025
The cyberattacks on Azerbaijani media outlets hit more than ten major media platforms on 20 February 2025, including sites of one large media group, and restricted access to many of them.
In short
The cyberattacks on Azerbaijani media outlets hit more than ten major media platforms on 20 February 2025, including sites of one large media group, and restricted access to many of them. On 2 May 2025 a parliamentary commission chairman said the attacks were attributed to APT29, a Russian-linked espionage group, and called them politically motivated. He said the group had been inside some platforms for two to three years.
What happened
On 20 February 2025 a cyberattack struck more than ten major Azerbaijani media platforms. Tech.az reported that day that access to many websites of one large media group was restricted and that users had trouble opening them. It also reported that the main page of the Report News Agency showed phrases placed by the attackers.
On 2 May 2025 Ramid Namazov, chairman of the parliamentary commission on foreign interference and hybrid threats, gave the findings at a public hearing. He said two independent teams investigated and reached matching findings. He said one large media group infrastructure was infected with malware and its central management system was taken over. He said web server data and backups were deleted and media resources destroyed.
Namazov attributed the attack to APT29, a Russian-linked cyber espionage group, and called it a politically motivated incident of cyber interference. He tied the motive to the 3 February order to close the Russian House in Baku and to talk of closing the local office of Rossiya Segodnya (Sputnik). He said some media outlets had prepared reports on those two issues. He also said an operation known as a false flag was carried out.
He said attempts at attacks continued after systems were restored, but were thwarted. He said some individuals involved were in Azerbaijan and were foreigners. These are the statements of one parliamentary commission. No court filing or technical report was opened for this page.
Timeline
-
3 February 2025
The Russian House in Baku is ordered to cease its activities, and closure of the local Rossiya Segodnya (Sputnik) office is under discussion, according to Namazov.
-
Before 20 February 2025
Namazov says APT29 had been inside certain media platforms for two to three years.
-
20 February 2025
The attack hits more than ten major Azerbaijani media platforms. Tech.az reports restricted access to many websites of one large media group.
-
20 February 2025
Namazov says the group seized a system administrator's computer, reached the server holding backups, and then moved to other media resources.
-
20 February 2025
Namazov says web server data and backups were deleted and media resources destroyed.
-
After restoration
Namazov says further attack attempts continued but were thwarted.
-
2 May 2025
At a public hearing Namazov says the attack is attributed to APT29, after two independent teams reached matching findings.
-
2 May 2025
The Kyiv Independent and Ukrainska Pravda report the attribution; they differ on which Russian service APT29 is linked to.
How the attack worked
The public account is Namazov’s statement of 2 May 2025. It gives the outline of the attack but not a full technical report. The steps below are only what he said.
Early access
Namazov said APT29 had been inside certain media platforms for two to three years. He described the group’s usual tactic as getting into a system long in advance, setting up a way to stay, and waiting until the moment to act. Ukrainska Pravda reported him as saying the attackers had penetrated the media networks in advance.
Taking control
He said the internal infrastructure of one large media group was infected with malware and its central management system was fully taken over. The system administrator’s computer was seized. That gave access to the server where backup copies of all internet resources were kept.
Destruction and pressure
From there the attackers moved to other media resources. Namazov said web server data and backups were deleted, media resources were destroyed and access to the infrastructure was restricted. He said the attack was not only technical but also aimed at psychological impact, and that its aim was to damage trust in the media sector.
How the finding was made
Namazov said two independent teams examined system logs, traces of malicious software and the behavior of the attackers, and their findings matched. He said the IP addresses, domains and connections of the group were identified, and that some support came from domestic IP addresses.
- Early accessAPT29 is said to have been inside some media platforms for two to three years
- Malware on the coreNamazov says one large media group infrastructure was infected and its central management system taken over
- Admin and backupsNamazov says the administrator’s computer was seized and the backup server was reached
- DestructionNamazov says web server data and backups were deleted and media resources destroyed
Who says who was behind it
Who attributed it, and how firm it is
Attributed by Ramid Namazov, chairman of the Parliamentary Commission on Foreign Interference and Hybrid Threats, 2 May 2025: the attack was carried out by APT29, a Russian-linked cyber espionage group, which he said experts classify as state-affiliated.
Sources differ on the Russian service: the Kyiv Independent wrote that APT29 is widely believed to be linked to Russia's Foreign Intelligence Service, while Ukrainska Pravda wrote that it is linked to Russian military intelligence.
Namazov also said a false flag operation was carried out. No court filing or independent technical report was opened for this page.
Impact
More than ten major Azerbaijani media platforms were targeted, according to Namazov. Tech.az reported that access to many websites of one large media group was restricted on 20 February 2025. Namazov said web server data and backups were deleted, media resources were destroyed and access to the infrastructure was restricted. He said experts called it one of the most serious cyber intrusion operations identified in Azerbaijan. The sources opened give no figures for visitors, downtime or cost.
Government and regulator response
Namazov said the relevant institutions immediately took measures to secure the affected outlets. He said the media resources were restored and later attack attempts were thwarted.
The parliamentary commission on foreign interference and hybrid threats held a public hearing on 2 May 2025 and presented the findings. Two independent teams carried out the investigation, according to Namazov.
Namazov said the group’s IP addresses, domains and connections were identified, and that some individuals involved were foreigners present in Azerbaijan. The sources opened do not describe any arrest, charge or sanction.
Lessons
-
Backups are a target
Namazov said the attackers reached the server holding backups of all internet resources and deleted them. Backups need separate access and separate protection.
-
Admin machines are the key
The attackers seized the system administrator's computer. Treat administrator workstations as the most protected systems.
-
Long dwell time
Namazov said access began two to three years earlier. Looking only for new intrusions will miss old ones.
-
Motive can follow politics
The commission tied the attack to the closure of the Russian House and a possible Sputnik closure. Media outlets that report on sensitive issues should expect more attacks around those events.
-
Attribution is a statement, not a proof
Sources differ on which Russian service APT29 is linked to, and Namazov mentioned a false flag. Treat any attribution as one body's view.
What to check in your own organization
-
Backup separation
Check that backups sit outside the main management network and cannot be deleted with the same administrator account.
-
Administrator workstations
List who can administer your web servers and check those computers for malware and unusual logins.
-
Central management
Check who can reach your central management system and alert on new access to it.
-
Old access
Look for old accounts, tools or connections that have been quiet for months, since quiet access can last years.
-
Restore test
Test restoring your websites from clean backups and time it.
-
Log retention
Check how long logs are kept so a long-running intrusion can still be traced.
-
Staff awareness
Brief reporters and editors on targeted phishing around sensitive stories.
Where it happened
Questions
Who attacked the Azerbaijani media outlets?
On 2 May 2025 the chairman of a parliamentary commission said the attack was attributed to APT29, a Russian-linked espionage group. This is his statement; no court filing was opened.
When did the attack happen?
On 20 February 2025, according to Namazov and Tech.az.
Which Russian service is APT29 linked to?
Sources differ. The Kyiv Independent wrote Russia's Foreign Intelligence Service. Ukrainska Pravda wrote Russian military intelligence.
How many media platforms were hit?
More than ten major platforms, according to Namazov.
Why were the media outlets attacked?
Namazov tied it to the 3 February order to close the Russian House in Baku and talk of closing the local Sputnik office, and said some outlets had prepared reports on those issues.
What damage was done?
Namazov said malware infected one large media group infrastructure, its central management system was taken over, and web server data and backups were deleted.
Sources
- Russian-linked APT29 behind recent cyberattacks on Azerbaijani media - official (2 May 2025) Trend News Agency
- Purpose and motives behind February 20 cyberattacks on Azerbaijan's media revealed (2 May 2025) APA
- Azerbaijani lawmaker blames Russia for February cyberattack (May 2025) Kyiv Independent
- Azerbaijan says Russia was behind massive cyberattack (2 May 2025) Ukrainska Pravda
- An extremist group has launched a cyberattack on Azerbaijani news websites (20 February 2025) Tech.az
- APT29, Group G0016 MITRE ATT&CK
- Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.