Threat Actor Characterization
Armenian Cyber Army
ID: 3ce924a16d1bbf3d9f5da7a129a4cdc593582Actor Network Graph
Open Network GraphMITRE ATT&CK®
Armenian Cyber Army (ACA) — Armenian hacktivist label visible in open sources since at least 2013, credited with politically framed defacements of Azerbaijani websites (e.g., Azerbaijani ministry sites in Mar 2013; 26 sites tied to the Sumgait anniversary in Jan 2016) and with a January 2016 leak of ~16K user records from an Azerbaijani blog platform. Distinct from Monte Melkonian Cyber Army (MMCA) and Caucasus Cyber Army (CCA), which are separate Armenian labels active in the same conflict theater.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1491.002 | External Defacement | TA0040 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Armenian Cyber Army (ACA) is an Armenian hacktivist label credited in open sources with website defacements and at least one data leak during cycles of Armenian–Azerbaijani cyber hostilities. Documented cases include (i) the defacement of an Azerbaijani Ministry of Labor and Social Defense site in March 2013 (with a prior break noted on Feb 27, linked to the Sumgait anniversary), and (ii) a multi-site defacement run (26 domains) around January 14, 2016 tied to commemorative dates. In January 2016, ACA was also reported to have leaked ~16K user records from the Azerbaijani blog platform Kayzen.em. While ACA’s activities overlap temporally and thematically with other Armenian labels (notably Monte Melkonian Cyber Army and Caucasus Cyber Army), the cited items attribute these specific incidents to Armenian Cyber Army as a distinct banner. Open sources, however, provide limited technical details on vectors and post-exploitation depth. Overall confidence: medium.
- 2013-02-27. ACA reportedly compromises Azerbaijan’s Ministry of Labor and Social Defense website linked to Sumgait anniversary; commemorative content posted. — Armenpress
- 2013-03-11. Ministry of Labor and Social Defense (Azerbaijan) defaced again; Armenian Cyber Army logo displayed. — Armenpress
- 2016-01-14. 26 Azerbaijani websites “broken” by Armenian Cyber Army ahead of the 26th anniversary of the Sumgait pogroms (per Samvel Martirosyan via ARKA). — arkatelecom.am
- 2016-01-20. ACA leak (~16K users) from Azerbaijani Kayzen.em blog platform; SQL/user databases linked. — en.aravot.am
- 2016-01-20. CivilNet overview: on the same day of reciprocal cyber actions, Armenian Cyber Army “leaked 16K database from Azerbaijani platforms.” — civilnet.am