According to Turan News Agency, a member of the opposition Popular Front Party Elnur Hasanov was sentenced to 30 days of administrative detention over critical posts shared on social media.
The press service of the Ministry of the Interior refuted the claims the arrest of the activist was political.
Scores of political activists have been facing pressure, arrests, and detentions in recent months in Azerbaijan over their comments, and posts on Facebook. In May 2022, AIW published a legal analysis of content regulation in Azerbaijan. At the time, an uptick in cases in which social media users faced punitive measures by the Prosecutor’s General Office for their online activism indicated that the Office has taken on a temporary role of taking measures against activists, journalists, and media within the scope of laws on information and media. But continuing involvement of the Office in handing out fines and warnings may indicate that in addition to punitive measures, there is a plan to introduce legal measures on social media platforms.
Political activist Bakhtiyar Hajiyev was unlawfully detained yet again according to reports by Azerbaijani media. During the interrogation, which lasted six hours, Hajiyev’s Facebook posts in which he criticized the Ministry of the Internal Affairs were removed.
In his own statement, Hajiyev said, he was threatened that less he removed the posts, and stops writing about the Ministry of Internal Affairs, he will face further measures. But activists said, his recent posts specifically targeted the ministry for not letting Hajiyev visit Shusha – a city in Karabakh that was captured following the 44-day war between Armenia and Azerbaijan.
Hajiyev said he had no intentions to complain given there is nowhere to complain and that instead, he has submitted an official request to give up his Azerbaijani citizenship. “I am concerned about my life and no longer want to be a citizen of Azerbaijan. Let the head of state decide, whether the law enforcement can treat people this way,” the political activist told Turan News Agency in an interview.
The unlawful detention and interrogation are the latest, in attacks against the political activist. In April of this year, Hajiyev was kidnapped, taken to an undisclosed location, and was forced to remove several Facebook posts under duress that criticized the Ministry of the Interior, including the minister himself, for failing to investigate his case and being the perpetrators of threats and attacks against him.
On June 23, Elchin Ibrahimli, a member of an opposition party was detained according to local news reports. He was sentenced to 30 days in administrative detention the following day, said members of the party. According to reports, the activist allegedly resisted police and as a result was sentenced on charges of resisting the police according to the Code of Administrative Offenses, Article 535.
In a statement issued by the Ministry of the Interior, the blogger is said to have failed to show up in person at the police station despite numerous invitations.
According to Azadliq Radio, Azerbaijan Service for Radio Liberty, Ibrahimli was arrested from his home. Speaking to the radio, Faig Jafarzade, the party regional head, said Ibrahimli is an active social media user and that his arrest is rooted in his political activism.
It’s been months since an investigation led by an international consortium of journalists and technology experts revealed how Pegasus, a hacking software developed and sold by an Israeli surveillance company, NSO group targeted civil society representatives globally. On the country lists of phone numbers identified to have been targeted with Pegasus were numbers that belonged to dozens of civil society activists in Azerbaijan. Abulfaz Gurbanli, a political activist, was among them.
After learning that his device was infected, Gurbanli wiped his entire device and had it reset. On February 15 after plugging his device into a power adapter, Gurbanli’s device was remotely reset. Shortly after, he lost access to his Gmail account. The reset got rid of the google authenticator Gurbanli had set up to access his email account. Within hours, the political activist also lost access to his Facebook profile. Although the URL was briefly inaccessible on Facebook, it has been reinstated. Gurbanli finally secured access to his account on February 17.
In addition to a remote reset, Gurbanli also had multiple attempts to hack into his Facebook and Telegram accounts earlier. AIW spoke with a digital security expert who took a closer look at the IP address where these attempts originated from, indicating that it was the same IP that targeted other activists in the past few months.
There is suspicion that Gurbanli’s device was re-infected with Pegasus. But these suspicions can only be confirmed after a thorough device forensic analysis.
Fake interview request
On February 15, Gurbanli received an email from BBC Azerbaijan Service asking him for an interview.
Screenshot of the email sent to Gurbanli on February 15.
The journalist, who introduced herself as Sevinc, also contacted Gurbanli via WhatsApp.
Screenshot of Gurbanli receiving a message on WhatsApp.
Translation:
Sevinc: Hello Mr. Abulfaz. Writing to you from BBC Azerbaijan service, journalist Sevinc. I have a few questions about the agenda topics. Can you please share your email address and send us suitable pictures for the BBC website? Gurbanli: Hello Ms. Sevinc. Thank you. I wanted to clarify whether you are referring to stories published on virtualaz.org and haqqin.az when you refer to the agenda topics? Sevinc: It is about your projects and other political agenda. Gurbanli: [sends his email address] Sevinc: ok, check your email, there is a file with questions you can check on your computer. If the file requests a code, just write bbc and send us a suitable picture. Gurbanli: Ms. Sevinc how do I know the link you have sent does not have a virus. I hope you understand this and I apologize for hesitating. Sevinc: Mr. Abulfaz, the file does not contain virus, don’t worry. Can you please send a picture?
AzNet Watch has written to azeri@bbc.co.uk – the official email address of the Azerbaijan service informing the service of the incident.
AzNet Watch also requested assistance from Qurium media to analyze the link shared in the email and despite the journalist’s assurances, the link did contain a virus. “The mail pointed to a RAR compressed file in Google Drive that once downloaded required a password to be decrypted. The password to decrypt the file was included in the phishing e-mail: bbc. Compressed files that are password protected are common in malware phishing attacks as the files can not be scanned by antivirus,” concluded Qurium in its preliminary report. Further forensics report identified malware written in AutoIT. Once the link (in our case the link to a drive where the alleged journalist left questions for the political activist) was opened, the hacker through the deployed malware installed a persistent backdoor in the system. “The software connects to the domain name smartappsfoursix{.}xyz to download the rest of his software requirements. It downloads gpoupdater.exe and libcurl.dll that look responsible for uploading files to the command and control server. During the execution of the malware several (10) screenshots of the Desktop were uploaded to the server,” reads the Qurium analysis.
Meanwhile, after taking over Gurbanli’s Facebook account, the hacker also deleted all of the content on at least seven of the community pages, where Gurbanli was an admin (screenshots below are from just two pages).
These attacks came shortly after a pro-government media published an article targeting Gurbanli accusing the political activist of allegedly organizing color revolutions in Azerbaijan.
For almost a month now, political activist, Bakhtiyar Hajiyev has been the target of multiple forms of online attacks. In an interview with AIW, Hajiyev said, from being impersonated online and fake social media accounts in his name, calling for protests, to on-going attempts to break into his social media accounts, it is a comprehensive list, the attacks are well-coordinated and they originate from the law enforcement agency.
Hajiyev explains that he can get, at least ten passwords reset requests a day for messaging services like Whatsapp, his social media accounts on Twitter, Instagram and Facebook as well as applications like Paypal and Uber. “I have been getting password reset requests on platforms and accounts I never visited before or never set up. And in addition to all the social media accounts, there is the e-government portals that too inform me, of password reset requests.”
In one screenshot Hajiyev shared with AIW, there is evidence of countless incoming missed calls from numbers registered to the US and UK. These happen during certain hours of the day explains Hajiyev. Similar phone calls have been reported by other political activists too.
“I also receive calls from people who have been humiliated and called names online and then given my mobile number by the perpetrators, telling them to call me, since it is my doing. So I end up explaining to people that it was not me and that I would never do anything like this to anyone,” explained Hajiyev.
The offensive language is also being used against government officials and the ruling family explains Hajiyev.
Hajiyev believes it is his activism and outspokenness online that triggers these attacks. Whenever he has posted something that is clear evidence of an act of corruption, or a cover-up of government dealings, has been subject to similar forms of attacks and harassment. Taking into account, that it is not just him, but many other activists who are facing similar attacks, the intensity and the wide range of the attacks are indicative that they are coordinated and originate from one source – the law enforcement.
“These things are being done, in order to avoid any sort of political mobilizing once the quarantine period is over,” Hajiyev told Azadliq Radio in an interview on May 24.
“I have informed the State Security Service about these attacks and I have shared all the necessary information. And although I have been promised an investigation and answers, I am yet to see anything,” Hajiyev told to AIW. Hajiyev also told AIW that his name appears in message exchange among police officers [whoever has access to these numbers, must be affiliated with the authorities because these are personal numbers of police explains Hajiyev] attempting to incriminate Hajiyev.
Most recently, Hajiyev was harassed in a post written by the ruling party’s youth branch.
AIW continues to document this and other digital attacks and threats against representatives of Azerbaijan Civil Society.
![Deliberate targeting in pro government media leads to targeted attacks online – the case of Abulfaz Gurbanli [Updated]](https://www.az-netwatch.org/wp-content/uploads/2022/02/malware-600x300.jpeg)
