Who is behind the attacks on government websites?

A large-scale cyberattack targeting Azerbaijan’s state information infrastructure was carried out in the early hours of October 13. More than 100 government domains were targeted, disrupting access to the official websites of several ministries and state institutions.

The State Service for Special Communications and Information Security (SSSCIS) promptly issued a statement, saying the attack had been carried out by a foreign hacker group and contained through rapid response measures.

Commenting on the incident, ICT expert Osman Gunduz said the attack bore the hallmarks of a large-scale distributed denial-of-service (DDoS) operation, while various claims about those responsible were circulating on social media, TodayPress TV reports.

“A large-scale cyberattack targeting state information infrastructure was carried out in the early hours of October 13. More than 100 government domains were targeted, disrupting the operation of numerous government websites, including those of several ministries. The SSSCIS promptly issued a statement saying the attack had been carried out by a foreign hacker group. As a result of rapid response measures, the impact of the attack was contained within a short period, and the websites were restored,” he said.

The expert also addressed reports about the groups allegedly responsible for the attack.

“What happened? The initial indicators suggest that this was a large-scale DDoS attack. Such attacks involve sending excessive numbers of requests to servers, making websites inaccessible to users.

“Claims have already emerged on social media that the attack was carried out by groups known as 313 Team, Cypher and Litterbox. Some social media posts also allege that the attack originated in Turkey. However, 313 Team is identified in open sources as a pro-Iranian hacker group associated with Iraq. So far, the attack’s precise origin has not been confirmed,” Gunduz said.

While praising the work carried out in recent years, the expert stressed that vulnerabilities remain when it comes to defending against attacks of this scale.

“Considerable efforts have been made in Azerbaijan in recent years to strengthen the cybersecurity of government information systems, particularly critical information infrastructure. Nevertheless, it appears that the measures implemented are not yet sufficient to ensure the uninterrupted operation of all government websites during attacks of this magnitude,” he noted.

Concluding his remarks, Gunduz offered recommendations to the relevant authorities on investigating the incident and strengthening cybersecurity mechanisms.

“In my view, the SSSCIS should prepare a more detailed investigation and report on this incident. The sources and nature of the attack, the number of affected websites and the reasons why existing defence systems failed to ensure full resilience should be clarified.

“At the same time, efforts to strengthen the cyber defence of government institutions, backup infrastructure and recovery mechanisms should be intensified. These events require the relevant government agencies to take an even more responsible approach to cybersecurity and digital resilience,” he said.

Turkan Isgandarli