Threat Actor Characterization
Caucasus Cyber Army
ID: 0c40fe6f1df971b579381406d9a3579673371| CCA | Կովկասյան Կիբեր Բանակ | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Caucasus Cyber Army (CCA) — Armenian hacktivist label explicitly credited in 2014–2015 with politically framed website defacements against Azerbaijani, Hungarian, and Turkish targets. Open sources cite commemorative operations linked to the Gurgen Margaryan case (Feb 2014) and a mass campaign against ~300 Turkish sites (Apr 2015).
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1491.002 | External Defacement | TA0040 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Caucasus Cyber Army (CCA) is an Armenian hacktivist label that appears in open sources tied to high-visibility defacements during 2014–2015. Reporting credits CCA with (1) commemorative hacks on Azerbaijani and Hungarian sites marking the 10th anniversary of the murder of Lt. Gurgen Margaryan (Feb 2014), and (2) a mass defacement wave against ~300 Turkish websites on 23 April 2015 tied to the Armenian Genocide centennial. Public coverage emphasizes symbolic messaging and historical/commemorative frames rather than technical detail. There is no reliable OSINT confirming deeper post-exploitation, data theft, or sustained access for CCA beyond the defacement layer. Overall confidence: medium for identity/use as a label and the two cited campaigns; low on any broader capability set.
- 2014-02-19. CCA defaces Azerbaijani and Hungarian websites in memory of Gurgen Margaryan; pages carry photos/text (“Murderer Must be Punished!”). — arkatelecom.am
- 2014-02-20. CivilNet digest notes: “Armenian Caucasus Cyber Army hacks websites in Azerbaijan and Hungary to honor Gurgen Margaryan.” — civilnet.am
- 2015-04-23. CCA reportedly defaces ~300 Turkish sites dedicated to the Genocide centennial (per Samvel Martirosyan’s post, relayed by ARKA). — arkatelecom.am
