Computer systems belonging to Armenian Prime Minister Nikol Pashinyan’s Office, the Central Bank and the Central Electoral Commission have been targeted by hackers.
Information security expert Samvel Martirosyan outlined the characteristics of the attacks.
“We are talking about two separate attacks. This report will examine the malware distributed by Candiru, a company whose spyware has emerged as an alternative to Pegasus, and which was deployed through an advertising platform. It will also address another attack that, according to experts, originated from Kazakhstan,” he wrote.
The cyberattacks against Armenian government institutions were uncovered by the Canadian research organization Citizen Lab. Its researchers managed to examine and identify the mechanisms used to deploy and distribute the malicious software, Factor.am reports.
“They entered into an arrangement with an advertising network. This is a very common practice: a website installs an advertising network’s software, the network places and displays advertisements on websites, and the website receives a percentage of the revenue. In this case, this major advertising company effectively entered into an arrangement with Candiru and infected people through advertisements,” Martirosyan explained.
According to the media expert, the infections were not random but targeted, directed at specific individuals and organizations.
“The attacks were extremely widespread. In Armenia, the most frequently used website was mamul.am. I want to emphasize that you should absolutely not assume that this website was involved or responsible in any way. It simply hosted banners from that advertising network. The advertisements were displayed approximately one million times, of which 100,000 are estimated to have been targeted, attack-related data collection or malicious impressions,” the expert stressed.
The Candiru spyware used in the cyberattack is of Israeli origin. It has been compared to the widely known Pegasus spyware, which was previously used in large-scale hacking operations, particularly during the 44-day war in 2020.
The Israeli company that developed the software sold it to Azerbaijan. During that period, Android and iPhone devices belonging to representatives of government institutions, journalists and employees of foreign diplomatic missions were infected through the software.
“Strangely, since 2024, we at CyberHUB have been unable to detect new infections while examining phones. On the one hand, this might seem like a good thing. But in this field, when you see that nothing is happening and you are dealing with Azerbaijan, it is highly unlikely that it has no intention of doing anything or gathering the same kind of intelligence information,” Martirosyan emphasized.
As for who was behind the latest infections — Israel, Azerbaijan or both countries acting together — Martirosyan said he could not determine that.
At the same time, he pointed out that another report was published the day after the Candiru findings were disclosed. According to that report, a different hacking group targeted the Ministry of Foreign Affairs and International Trade in early 2026. In this case, the evidence points toward Kazakhstan.
“These hackers are Russian-speaking, so it cannot be ruled out that they may also be from Russia, attempting to conceal their identity and present themselves as operating from Kazakhstan,” the media expert suggested.
Although the cyberattacks have been detected, it remains unknown what data and information the hackers managed to obtain. The question of which country is ultimately behind the operations also remains unresolved.
