Candiru Spyware Targets Armenian Government Institutions
Citizen Lab uncovered targeted cyberattacks using Israeli-made Candiru spyware against Armenia's Prime Minister's Office, Central Bank, and Central Electoral Commission.
The Canadian research organization Citizen Lab uncovered a series of targeted cyberattacks against the computer systems of the Armenian Prime Minister's Office, the Central Bank, and the Central Electoral Commission. The attacks utilized Candiru spyware, which was distributed through a major advertising network to infect specific devices.
Information security expert Samvel Martirosyan estimated that the operation involved approximately 100,000 malicious impressions. While the Candiru software is of Israeli origin, it was sold to Azerbaijan. It remains unclear whether the Government of Azerbaijan, Israel, or both were responsible for the infections.
These events follow a separate hacking operation in early 2026 that targeted the Armenian Ministry of Foreign Affairs and International Trade. That specific breach has been linked to Russian-speaking hackers operating from Kazakhstan or Russia.
