Azerbaijan Internet Watch
  • About
  • News
  • Technical analysis
  • Incident reports
  • Contact

Tag: account hijacking

spotted, phishing attack on opposition activist [updated march 9]

Posted on March 8, 2021March 9, 2021 by aiw_admin
spotted, phishing attack on opposition activist [updated march 9]

Phishing and spear-phishing attacks targeting activists, rights defenders, journalists in Azerbaijan is a common occurrence. AIW has documented several of these attacks in recent years. Previously, these cases were investigated and reported by international organizations. The most recent victim of a spear-phishing attack in Azerbaijan was Ruhid Karimli, a political activist, and member of an opposition Popular Front party. 

Karimli, received a message on Facebook messenger, containing a link to this page on Facebook. At first glance, it looks like a page supporting opposition in Azerbaijan. However, Karimli, suspects that this page too was either hacked or is administered by the authorities. There is no information about the administrators, aside from gender [male] and birthday [April 15, 1969]. 

The activist, realized only after clicking on the link, that something was wrong. Quickly he lost access to his personal Facebook account. Karimli told AIW that his Facebook account was registered to his mobile number. Since the activist lost access to his Facebook profile, the number affiliated with the account was removed. When Karimli reached out to the new owners of his Facebook profile, he received a response in the Armenian language, calling him “dishonorable”. 

AIW is closely monitoring the developments and will be sharing updates both about the account recovery and the phishing attack in the following days.


In a separate case, another activist reports of a compromised Facebook account. Narmin Shahmarzade, said she lost access to her Facebook profile on March 9 in what looks like an attempt to discredit the activist. Shahmarzade, was among scores of women who took the streets on March 8, marking International Women’s day in the capital of Baku, and was detained by the police who prevented women from marching peacefully. In an interview with AIW, Shahmarzade said, the hacker, has removed her email and changed her user name. Ahead of March 8, another activist, Gulnara Mehdiyeva was targeted by a page, that leaked her sensitive personal audio messages on Facebook. In recent years, AIW has documented, scores of activists complain and report similar attempts of discrediting, hacking, and account compromise. In some cases, it was possible to investigate the source of attacks, leading to the government institutions in Azerbaijan. 

Posted in Incident reports, NewsTagged account hijacking, activist, azerbaijan, Facebook, Popular Front, spear-phishingLeave a Comment on spotted, phishing attack on opposition activist [updated march 9]

activist blackmailed online [updated September 9]

Posted on September 8, 2020September 14, 2020 by aiw_admin
activist blackmailed online [updated September 9]

Rustam Ismayilbeyli is an 18-year-old activist from Azerbaijan who was arrested earlier this summer for staging a protest outside the Ministry of Education. Together with a group of students, he was demanding that the Ministry cancels tuition fees and exams for the academic semester as a result of Covid19. After three of the organizers including Ismayilbeyli were admitted to the ministry police dispersed the crowd and arrested Ismayilbeyli as soon as he exited the government building. 

Ismayilbely was sentenced to 15 days in administrative detention on charges of allegedly disobeying police and violating the quarantine requirements. 

During his detention, his social media accounts and email were hacked. Although he was able to restore access, he was among targets on June 15 when someone with access to his National ID requested a password reset from the social media platform Facebook. It took Ismayilbeyli two months to recover his account. 

On September 7, a fake profile that belonged to the state security informed Ismayilbeyli that unless he steps down from being an organizer of an upcoming rally and starts collaborating with them, personal information including intimate photos of Ismayilbeyli and his girlfriend will be sent to his friends and acquaintances. 

The first account that threatened Ismayilbeyli had since been removed, the second account that did post personal information has removed the post. Instead, Ismayilbeyli told AzNetWatch, the same information is sent around via Whatsapp messenger, with the US number. His email and cloud were compromised during his arrest and Ismayilbeyli suspects, this is when these images were acquired.

Using burner numbers on WhatsApp targeting activists is not new in Azerbaijan. There are plenty of resources online that actually share tips on how to create a secondary line on WhatsApp. What is problematic however is up until now, it was not possible to identify the perpetrators.

On September 9, Ismayilbeyli also reported an attempted break-in into his Telegram account. In a tweet Ismayilbeyli said he keeps receiving verification codes via SMS on his mobile but because he had 2FA in place the account was not compromised.

Telegram hesablarımıza müdaxilə var. Əsas Telegram accountuma girməyə çalışdılar, indi də digər işlətmədiyim nömrəmlə yeni Telegram accountu açıblar, niyə bilmirəm.

— Rüstəm İsmayılbəyli (@demokratelebe) September 9, 2020

Translation: There is an attempt to break in my telegram account. They tried taking over my main Telegram account. Now, using a number that I normally don’t use, they have opened a new account. Not sure why.

Bu dəqiqə mənə gələn smsləri oxuyub verification code’la telegram’a girməyə çalışırlar, amma two step’i keçə bilmirlər.

— Rüstəm İsmayılbəyli (@demokratelebe) September 9, 2020

Translation: Right now, reading the verification codes I am receiving via SMS, they are trying to break into my Telegram account, but they can’t get past the 2FA.

Posted in Incident reports, NewsTagged account hijacking, azerbaijan, Facebook, hacking, hacking alert, harassment, online, online harassment, persecution, social media, whatsappLeave a Comment on activist blackmailed online [updated September 9]
Azerbaijan Internet Watch
  • About
  • News
  • Technical analysis
  • Incident reports
  • Contact
Loading
© Azerbaijan Internet Watch, 2020