ICT

Home page

ICT

NCA: Cyberattack attempts recorded against user accounts of some organizations in Azerbaijan

18 August 2026 17:34 (UTC +04:00)

Coordinated attempts to access the user accounts of several institutions and organizations operating in Azerbaijan have been recorded, APA-Economics reports, citing the National Cybersecurity Agency (NCA).

“Observations show that cyber attackers are attempting to gain unauthorized access to user accounts through various methods. In addition to foreign IP addresses, they also use VPN and proxy infrastructures that provide Azerbaijani IP addresses in order to make their traffic appear as legitimate connections originating from Azerbaijan and to bypass possible geographical restrictions.

The main purpose of the cyberattacks is to gain unauthorized access to Microsoft 365 and other email environments in order to obtain confidential information, electronic correspondence and other sensitive data belonging to institutions and organizations,” the statement said.

In this regard, the National CERT recommends that organizations and institutions implement the following measures to strengthen the security of user accounts:

checking login logs, particularly analyzing logins recorded on the same day from both foreign countries and Azerbaijani IP addresses;

investigating multiple failed login attempts against multiple accounts from the same source;

identifying suspicious successful logins;

enabling multi-factor authentication (MFA) for all user accounts.

The indicators of compromise (IOCs) associated with the observed activity are as follows:

146.70.247[.]20

179.43.158[.]195

130.94.80[.]141

94.20.154[.]138

35.178.160[.]238

Azerbaijan National Cybersecurity Agency NCA cyberattack cybersecurity user accounts Microsoft 365 National CERT MFA unauthorized access data security cyber threats