Spies hacked Azerbaijan government officials as Nagorno-Karabakh conflict escalated, researchers say

The data from Talos shows how digital espionage often coincides with bursts of violence in modern war.

More than 200 people have died in clashes between ethnic Armenian separatists and Azerbaijani government forces over the breakaway region of Nagorno-Karabakh in the last 10 days.

It’s the worst outbreak of violence related to Nagorno-Karabakh since Armenia and Azerbaijan, two former Soviet republics, fought a war over the enclave in the 1990s. And this time, hacking has come with the fighting.

Unidentified spies have in recent weeks been quietly breaching Azerbaijani government IT networks and accessing the diplomatic passports of certain officials, according to new research from Talos, Cisco’s threat intelligence unit.

The Talos data shows how digital espionage often coincides with bursts of violence in modern war. Days after Azerbaijan’s president made a call to mobilize reserve soldiers, the hackers used a fake Azerbaijani government document on the same subject as bait. The malicious code embedded in the document can exfiltrate data from a compromised computer and gives the hackers enduring access to the machine.

The research comes a day after the U.S. and Russia called for a ceasefire in Nagorno-Karabakh, which is governed by ethnic Armenians but recognized under international law as part of Azerbaijan.

The Talos researchers declined to discuss who was responsible for the hacking, or how many Azerbaijani government officials were affected. They called the activity “espionage with national security implications” carried out by a group “with a specific interest in various Azerbaijani government departments.”

“We cannot confirm information regarding [this] particular case of cyber-espionage,” said Asmar Yusifzada, a spokesperson for the Azerbaijani Embassy in Washington, D.C. “Azerbaijan treats the issue of cybersecurity with utmost attention.”

A spokesperson for the Armenian Embassy did not respond to a request for comment.

From Shakespeare to Dostoevsky

The Talos researchers first exposed the espionage group targeting Azerbaijani officials in April, calling their hacking tool “PoetRAT” because the code was littered with literary references. Whereas William Shakespeare was the calling card before, the most recent updates to the code include allusions to Russian writer Fyodor Dostoevsky.

After being outed by Talos, the hackers made PoetRAT harder to detect. They’re now using a common protocol for data exfiltration to try to be inconspicuous.

Warren Mercer, technical leader at Talos, said he expects PoetRAT’s authors to keep changing their code in response to public scrutiny. The research also shows how “there are less barriers to entry to perform cyberattacks,” Mercer said.

A study conducted last year by federal officials and private executives underscores that point.

“The increasing ability to buy cyber tools on a commercial basis allows both nation-state and non-state actors to leapfrog by crossing the line from emerging threat to an established threat quickly,” says the study, which was carried out under a Department of Homeland Security program.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure