{ "id": "7928b37b-f5c9-44ec-a648-8e4dfa71ce7c", "created_at": "2026-04-06T00:06:12.001301Z", "updated_at": "2026-04-10T13:12:38.780589Z", "deleted_at": null, "sha1_hash": "f3e46545c6e99b2c5b7ee5e42082927b89fc94e3", "title": "Azerbaijan blames Russian state hackers for cyberattacks on local media", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 79119, "plain_text": "Azerbaijan blames Russian state hackers for cyberattacks on local\r\nmedia\r\nBy Daryna Antoniuk\r\nPublished: 2025-05-05 · Archived: 2026-04-02 12:22:44 UTC\r\nAzerbaijani officials claimed that the Russian state-sponsored hacker group APT29 was behind a cyberattack on\r\nseveral local media outlets earlier this year.\r\nThe likely motive, according to Ramid Namazov, head of the Azerbaijani parliament's commission on countering\r\nhybrid threats, was retaliation for the closure of the Russian House state-funded cultural center in Baku and\r\nsignificant staff cuts at the Azerbaijani branch of Sputnik radio.\r\nIn February, the Azerbaijani government ordered the closure of the Russian House, citing its lack of legal\r\nregistration and violations of national legislation. Local media also reported that the center had been involved in\r\nespionage activities on behalf of Russian intelligence. Russia dismissed the allegations as a “groundless”\r\ndisinformation campaign.\r\nAzerbaijani authorities cut the staff of the Kremlin-backed outlet Sputnik Azerbaijan from 40 to a single employee\r\nearlier this year, saying the move was aimed at “restoring balance” in the conditions under which Azerbaijani state\r\nmedia and foreign journalists operate in the country.\r\nThe cyberattack on Azerbaijani media took place on the morning of February 20. It initially targeted the internal\r\nservers of the Baku TV channel — which had accused the Russian House of espionage — before spreading to\r\nseveral news websites.\r\nAccording to local authorities, the attack aimed to spread disinformation and false news, disrupt media\r\ninfrastructure and attempt to delete or alter information.\r\nNamazov said the incident was “politically motivated” and claimed that Russian hackers had penetrated the\r\naffected websites two to three years before the actual incident.\r\nAPT29, also known as Cozy Bear, BlueBravo or Midnight Blizzard, is reportedly affiliated with Russia’s Foreign\r\nIntelligence Service (SVR). The group is primarily engaged in cyber-espionage, targeting government agencies,\r\nforeign diplomatic missions, and organizations in the political, defense, energy and media sectors.\r\nAzerbaijan has historically maintained ties with Russia through trade, energy and security cooperation. However,\r\ntensions have escalated recently — partly due to Baku's support for Ukraine. The December crash of Flight J2-\r\n8243, which Azerbaijan blamed on a Russian missile, also complicated the relationship.\r\nIn March, Ukraine’s military intelligence agency, known as HUR, reported that Russia was spreading\r\ndisinformation accusing HUR of trying to instigate an armed conflict between Armenia and Azerbaijan.\r\nhttps://therecord.media/azerbaijan-blames-media-cyberattacks-russia-apt29\r\nPage 1 of 2\n\nCyberattacks on media outlets are commonly used by Russian hackers to spread disinformation or collect data.\r\nLast year, suspected Russian hackers targeted the Polish Press Agency to publish fake news on its website.\r\nIn February, Kremlin-linked threat actors also attacked several major Ukrainian media outlets, posting fake news\r\nrelated to the war.\r\nDaryna Antoniuk\r\nis a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in\r\nEastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for\r\nForbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.\r\nSource: https://therecord.media/azerbaijan-blames-media-cyberattacks-russia-apt29\r\nhttps://therecord.media/azerbaijan-blames-media-cyberattacks-russia-apt29\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://therecord.media/azerbaijan-blames-media-cyberattacks-russia-apt29" ], "report_names": [ "azerbaijan-blames-media-cyberattacks-russia-apt29" ], "threat_actors": [ { "id": "5b748f86-ac32-4715-be9f-6cf25ae48a4e", "created_at": "2024-06-04T02:03:07.956135Z", "updated_at": "2026-04-10T02:00:03.689959Z", "deleted_at": null, "main_name": "IRON HEMLOCK", "aliases": [ "APT29 ", "ATK7 ", "Blue Kitsune ", "Cozy Bear ", "The Dukes", "UNC2452 ", "YTTRIUM " ], "source_name": "Secureworks:IRON HEMLOCK", "tools": [ "CosmicDuke", "CozyCar", "CozyDuke", "DiefenDuke", "FatDuke", "HAMMERTOSS", "LiteDuke", "MiniDuke", "OnionDuke", "PolyglotDuke", "RegDuke", "RegDuke Loader", "SeaDuke", "Sliver" ], "source_id": "Secureworks", "reports": null }, { "id": "a241a1ca-2bc9-450b-a07b-aae747ee2710", "created_at": "2024-06-19T02:03:08.150052Z", "updated_at": "2026-04-10T02:00:03.737173Z", "deleted_at": null, "main_name": "IRON RITUAL", "aliases": [ "APT29", "Blue Dev 5 ", "BlueBravo ", "Cloaked Ursa ", "CozyLarch ", "Dark Halo ", "Midnight Blizzard ", "NOBELIUM ", "StellarParticle ", "UNC2452 " ], "source_name": "Secureworks:IRON RITUAL", "tools": [ "Brute Ratel C4", "Cobalt Strike", "EnvyScout", "GoldFinder", "GoldMax", "NativeZone", "RAINDROP", "SUNBURST", "Sibot", "TEARDROP", "VaporRage" ], "source_id": "Secureworks", "reports": null }, { "id": "46b3c0fc-fa0c-4d63-a38a-b33a524561fb", "created_at": "2023-01-06T13:46:38.393409Z", "updated_at": "2026-04-10T02:00:02.955738Z", "deleted_at": null, "main_name": "APT29", "aliases": [ "Cloaked Ursa", "TA421", "Blue Kitsune", "BlueBravo", "IRON HEMLOCK", "G0016", "Nobelium", "Group 100", "YTTRIUM", "Grizzly Steppe", "ATK7", "ITG11", "COZY BEAR", "The Dukes", "Minidionis", "UAC-0029", "SeaDuke" ], "source_name": "MISPGALAXY:APT29", "tools": [ "SNOWYAMBER", "HALFRIG", "QUARTERRIG" ], "source_id": "MISPGALAXY", "reports": null }, { "id": "70872c3a-e788-4b55-a7d6-b2df52001ad0", "created_at": "2023-01-06T13:46:39.18401Z", "updated_at": "2026-04-10T02:00:03.239111Z", "deleted_at": null, "main_name": "UNC2452", "aliases": [ "DarkHalo", "StellarParticle", "NOBELIUM", "Solar Phoenix", "Midnight Blizzard" ], "source_name": "MISPGALAXY:UNC2452", "tools": [ "SNOWYAMBER", "HALFRIG", "QUARTERRIG" ], "source_id": "MISPGALAXY", "reports": null }, { "id": "20d3a08a-3b97-4b2f-90b8-92a89089a57a", "created_at": "2022-10-25T15:50:23.548494Z", "updated_at": "2026-04-10T02:00:05.292748Z", "deleted_at": null, "main_name": "APT29", "aliases": [ "APT29", "IRON RITUAL", "IRON HEMLOCK", "NobleBaron", "Dark Halo", "NOBELIUM", "UNC2452", "YTTRIUM", "The Dukes", "Cozy Bear", "CozyDuke", "SolarStorm", "Blue Kitsune", "UNC3524", "Midnight Blizzard" ], "source_name": "MITRE:APT29", "tools": [ "PinchDuke", "ROADTools", "WellMail", "CozyCar", "Mimikatz", "Tasklist", "OnionDuke", "FatDuke", "POSHSPY", "EnvyScout", "SoreFang", "GeminiDuke", "reGeorg", "GoldMax", "FoggyWeb", "SDelete", "PolyglotDuke", "AADInternals", "MiniDuke", "SeaDuke", "Sibot", "RegDuke", "CloudDuke", "GoldFinder", "AdFind", "PsExec", "NativeZone", "Systeminfo", "ipconfig", "Impacket", "Cobalt Strike", "PowerDuke", "QUIETEXIT", "HAMMERTOSS", "BoomBox", "CosmicDuke", "WellMess", "VaporRage", "LiteDuke" ], "source_id": "MITRE", "reports": null }, { "id": "f27790ff-4ee0-40a5-9c84-2b523a9d3270", "created_at": "2022-10-25T16:07:23.341684Z", "updated_at": "2026-04-10T02:00:04.549917Z", "deleted_at": null, "main_name": "APT 29", "aliases": [ "APT 29", "ATK 7", "Blue Dev 5", "BlueBravo", "Cloaked Ursa", "CloudLook", "Cozy Bear", "Dark Halo", "Earth Koshchei", "G0016", "Grizzly Steppe", "Group 100", "ITG11", "Iron Hemlock", "Iron Ritual", "Midnight Blizzard", "Minidionis", "Nobelium", "NobleBaron", "Operation Ghost", "Operation Office monkeys", "Operation StellarParticle", "SilverFish", "Solar Phoenix", "SolarStorm", "StellarParticle", "TEMP.Monkeys", "The Dukes", "UNC2452", "UNC3524", "Yttrium" ], "source_name": "ETDA:APT 29", "tools": [ "7-Zip", "ATI-Agent", "AdFind", "Agentemis", "AtNow", "BEATDROP", "BotgenStudios", "CEELOADER", "Cloud Duke", "CloudDuke", "CloudLook", "Cobalt Strike", "CobaltStrike", "CosmicDuke", "Cozer", "CozyBear", "CozyCar", "CozyDuke", "Danfuan", "EnvyScout", "EuroAPT", "FatDuke", "FoggyWeb", "GeminiDuke", "Geppei", "GoldFinder", "GoldMax", "GraphDrop", "GraphicalNeutrino", "GraphicalProton", "HAMMERTOSS", "HammerDuke", "LOLBAS", "LOLBins", "LiteDuke", "Living off the Land", "MagicWeb", "Mimikatz", "MiniDionis", "MiniDuke", "NemesisGemina", "NetDuke", "OnionDuke", "POSHSPY", "PinchDuke", "PolyglotDuke", "PowerDuke", "QUIETEXIT", "ROOTSAW", "RegDuke", "Rubeus", "SNOWYAMBER", "SPICYBEAT", "SUNSHUTTLE", "SeaDaddy", "SeaDask", "SeaDesk", "SeaDuke", "Sharp-SMBExec", "SharpView", "Sibot", "Solorigate", "SoreFang", "TinyBaron", "WINELOADER", "WellMail", "WellMess", "cobeacon", "elf.wellmess", "reGeorg", "tDiscoverer" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775433972, "ts_updated_at": 1775826758, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/f3e46545c6e99b2c5b7ee5e42082927b89fc94e3.pdf", "text": "https://archive.orkl.eu/f3e46545c6e99b2c5b7ee5e42082927b89fc94e3.txt", "img": "https://archive.orkl.eu/f3e46545c6e99b2c5b7ee5e42082927b89fc94e3.jpg" } }