Threat Actor Characterization
Karabakh Hacking Team
ID: 25adbb7a464df3f92ecb04395b01569901952| KHT | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Karabakh Hacking Team is an Azerbaijani nationalist, conflict-linked hacktivist brand most visibly associated with the 2020 Nagorno-Karabakh war. Public reporting links it to Armenian website defacements, propaganda-centered content replacement, and claims of access to Armenian government documents via MulberryGroupware.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1595 | Active Scanning | TA0043 |
|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1491.001 | Internal Defacement | TA0040 | |
| T1565.001 | Stored Data Manipulation | TA0040 |
|
| T1005 | Data from Local System | TA0009 |
|
Karabakh Hacking Team — Azerbaijani nationalist / conflict-linked hacktivist brand
Classification: TLP:WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hacktivism / Conflict-linked nationalist collective - Origin: Azerbaijan (assessed)
Author: iQBlack CTI Team
Executive Summary
Karabakh Hacking Team (KHT) is best assessed as an Azerbaijani nationalist hacktivist brand active in the information and cyber layer of the Armenia–Azerbaijan conflict, with its clearest public visibility during the September–October 2020 Nagorno-Karabakh war. Open-source reporting consistently links the name to website defacements, public propaganda, selective leak claims, and at least one publicly claimed compromise of the Armenian government’s electronic document management environment. The actor appears less like a long-lived, technically transparent intrusion set and more like a wartime mobilization brand that combined cyber disruption, symbolic messaging, and psychological pressure.
Public reporting most strongly supports three activity types. First, KHT publicly claimed and was externally reported as responsible for mass compromise and defacement of Armenian websites, including media outlets and official sites, where hacked pages were altered to display Azerbaijani state messaging, national symbols, and references to President Ilham Aliyev. Second, KHT was publicly associated with claims of access to Armenian government documents through compromise of MulberryGroupware v1/v2. Third, the group used Telegram-centered propaganda distribution to turn website compromises into narrative events rather than purely technical intrusions.