The Azerbaijan cybersecurity threat landscape in 2024 and 2025 was shaped by state-backed groups, hacktivists and cybercriminals. This report covers Russian and Iranian espionage groups, defacements and leaks linked to the Armenia-Azerbaijan conflict, and banking malware and ransomware aimed at Azerbaijani users.
Azerbaijan faced a rise in cyber threats, driven by regional tensions and sophisticated actors. State-backed hackers from Russia and Iran, alongside regional hacktivists, increasingly targeted government agencies, critical industries, and media outlets.Russian (APT29) and Iranian (Pioneer Kitten) APT groups focused on espionage. Hacktivists from both sides of the Armenia-Azerbaijan conflict conducted defacements and leaks. Cybercriminals targeted Azerbaijani users with banking malware and ransomware.
- Gain a Clear View of Azerbaijan’s Cyber Threat Landscape
Explore key incidents, threat actors, and sector-specific attacks shaping the country’s digital risk environment between 2024 and 2025. - Understand the Motives and Methods Behind the Threats
Learn how APT groups, hacktivists, and cybercriminals leveraged phishing, DDoS, and hybrid attacks to target critical Azerbaijani institutions. - Access Strategic Recommendations for National Cyber Resilience
Discover actionable guidance to fortify infrastructure, close vulnerabilities, and proactively monitor underground threats impacting .az domains.
What Does the Azerbaijan Threat Landscape Report Cover?
The report is dated 23 May 2025 and was written by the Brandefense Analyst Team. It looks at cyber threats to Azerbaijan from 2024 to early 2025. Its chapters are an executive summary, an introduction and methodology, sector-based threat exposure, a summary of key threat actors and notable incidents, dark web exposure, and trends and strategic outlook.
How Was It Put Together?
The report says its findings are based on open-source intelligence, public threat reports and observed incident data. It also says attribution may change as new data emerges, and that some incidents may remain undisclosed.
What Does It Say About Each Sector?
- Government: over 260 threats were identified in January and February 2025, a 42% increase on the same period a year earlier. A fake domain, govaz.am, was used in spear-phishing, and more than 130 employees across 32 institutions were compromised.
- Energy: in 2024, at least one energy company reported data exfiltration attempts believed to be linked to Iranian operators. The report says attackers exploited unpatched VPN infrastructure.
- Telecommunications: in late 2024, more than 50,000 DDoS attempts targeted major telecom providers.
- Finance: fraudulent SMS campaigns impersonating banks surged in mid-2024 and led to account takeovers. In Q3 2024 a major private bank reported unauthorized transfers linked to session hijacking via mobile.
Which Actors and Trends Does It Name?
The report names APT29 (Russia) for the February 2024 attack on Azerbaijani media outlets. It names Pioneer Kitten (Iran) for espionage against government and energy networks. It attributes a February 2025 hybrid attack to unknown actors that are likely state-linked. On the trend, it says actors moved from basic defacements to hybrid operations. It also lists unpatched systems (Citrix, F5), weak segmentation and poor credential practices as observed weaknesses.
What Does It Say About the Dark Web and Defense?
The report says thousands of Azerbaijani email and password combinations appeared in dark web data dumps. For defense, it recommends a stronger national cyber strategy, securing critical infrastructure, rapid patching, MFA, monitoring of underground forums and better user awareness. It also notes that a reporting platform for fake domains, blacklist.gov.az, was launched to assist early detection.
Our incident page on the February 2025 cyberattacks on Azerbaijani media outlets covers the attack that the parliamentary commission on foreign interference attributed to APT29.