Azeri human rights activists, journalists and political dissidents have been the targets of a fraudulent and sustained campaign using emails and Facebook chat, apparently aimed at gaining access to their personal information and private communications, said Amnesty International in a new report launched today.

The investigation reveals that the attacks, which can compromise passwords and contacts, have been directed at various government critics for the past 13 months. Victims told Amnesty they believed the Azerbaijani authorities are behind the attacks.

Claudio Guarnieri, Senior Technologist at Amnesty International, said:

“Our research reveals that a targeted and coordinated cyber campaign is being waged against critical voices in Azerbaijan, many of whom are long-time victims of government repression.

“The malware used has been designed with the express intention of gathering as much private information as possible about a target. Given the profiles of those targeted, it is not hard to see why victims believe the authorities are responsible.”

The report, ‘False Friends - how fake accounts and crude malware targeted dissidents in Azerbaijan’, details how victims have been targeted using a practice known as ‘spear phishing’, which involves an email with an attachment containing a virus - known as malware - being sent to a target from a fake address. If the recipient of the email clicks on the attachment, a virus is downloaded which relays images of the target’s screen back to the attacker and enables them to record what the target is typing.

The emails were mostly sent from addresses impersonating prominent human rights and political activists. One victim was the lawyer and human rights activist Rasul Jafarov, who was alerted to the attack when he received a phone call from a colleague in October last year warning him that he had been sent an email and attachment from an address very similar to his. A former Amnesty prisoner of conscience, Rasul Jafarov has previously spent more than a year and a half in prison on trumped-up, politically motivated charges stemming from his human rights work.

He told Amnesty:

“I believe that [the Azerbaijani authorities] are trying to closely watch everyone who is criticising the government, who is implementing different activities, or projects or campaigns which the government doesn’t like.”

Based on analysis of the attempted impersonation of Rasul Jafarov, and the first-hand accounts of other Azeri activists, Amnesty has uncovered widespread use of the practice, which started as early as November 2015. In other cases documented in the report, a dissident website called ‘Anonymous Azerbaijan’ was targeted, while the internal communications of the online news service, Kanal 13, were accessed for over a week following an attack. In another incident, malware was sent to several activists disguised as an invitation for a reception at the US Embassy in Baku.

The attachments in the fake emails are typically office documents with subjects that appear relevant to the recipient. One recent email included a document entitled ‘Political prisoners in Azerbaijan as of November 2016’, with the file’s metadata claiming it was created by human rights activist, Leyla Yunus. She and her activist husband Arif Yunus told Amnesty they believed the cyber attacks came from the government.

Denis Krivosheev, Deputy Director of Amnesty International’s Europe and Central Asia Programme, said:

“An already hostile environment for critics of the government is now even more difficult in light of these revelations. The chilling suggestion that all online activity is potentially being monitored has created unease among activists in Azerbaijan that is not only undermining their vital work, but also having a seriously detrimental impact on their day-to-day lives.”

Amnesty was not able to trace the cyberattacks directly to any government officials or agencies. However, an online identity going by the name of "pantera" - which appears to control the malware used in the attacks - has used an IP address from a “block” of addresses that predominantly hosts government infrastructure, such as the Ministry of Foreign Affairs, Ministry of Justice and state-owned television.

Amnesty presented the findings of the report to the Azeri government, who responded by saying the cases documented had not been reported to them and therefore have not been investigated.

Background

Independent journalists, human rights and opposition political activists in Azerbaijan often face online harassment. They have been subjected to abusive comments and threats on social media and websites, including via a government-backed trolling campaign. 

Monitoring of phone and internet communications in Azerbaijan is facilitated by laws which grant the authorities direct access to communications networks, a type of technical arrangement that has been criticised by the European Court of Human Rights. Surveillance can be carried out without the authorisation of a judge “for the purpose of preventing of grave crimes against individuals or especially dangerous crimes against the State.”

Azerbaijani dissidents have long reported hacking attempts against people critical of the authorities. Research by Citizen Lab and other public disclosures indicate that Azerbaijan had sought to acquire intrusion software from the Italian company Hacking Team. Leaked emails from Hacking Team describe sales to the Ministry of National Security by the Israeli technology company NICE Systems and attempted meetings with the Ministry of Internal Affairs. These same emails portray Azerbaijani intelligence entities as struggling to successfully operate Hacking Team’s platform.