The computers of Prime Minister Nikol Pashinyan's office, the Central Bank and the Central Election Commission have been targeted by a hacking attack. The infections were aimed at Windows computers, but phones were also targeted.
"It is still unclear whether advanced information has been collected on the phones; one can assume that this too will be used in other types of attacks," explains Samvel Martirosyan, co-founder of CyberHUB.am and information security expert.
The attack was discovered by Canada's Citizen Lab, which uncovered the mechanism of the malware's operation. According to Martirosyan, the hackers entered into a deal with an advertising network, which is a fairly common scheme: a website installs the advertising network's program, the network displays ads on websites, and the site receives a percentage of that. This large advertising company effectively struck a deal with Candiru and infected people through advertising.
The infections were not carried out randomly but were targeted, aimed at specific individuals and organizations. "The attacks were very massive; in Armenia, the mamul.am website was used the most. I want to emphasize that you should absolutely not think that this site is in any way involved, to blame, and so on; it's just that the advertising network's items were placed on their site. The ads were displayed about 1 million times, of which 100,000 are assessed as targeted, attack-oriented data-collecting or attack-oriented displays," the expert stresses.
Candiru is an Israeli program, like the well-known Pegasus, through which a large-scale hacking attack was carried out, particularly during the 44-day war. It was the Israeli company that sold the program to Azerbaijan, which during that period had managed to infect the Android and iPhone phones of employees of state institutions, journalists and foreign embassies.
The most concerning thing in this story is not the attack itself, but how it was carried out — through an ordinary advertising network, which is an everyday thing for millions of users. The targets were specific people, but the infection pathway was common to everyone.
The timeline is also noteworthy: since 2024, CyberHUB has not found new infections, which the expert himself considers strange given the neighborhood with Azerbaijan. At the same time, at the beginning of 2026, the traces of the attack on the Ministry of Foreign Affairs lead in a completely different direction.
Both cases show one thing: the digital protection of state institutions remains a serious issue, and as long as it is unknown what data has actually fallen into the attackers' hands, it is impossible to assess the true extent of the damage.
