Outage of Azerbaijani Government Websites (October 17)

A new massive wave of network disruptions was recorded today across the official websites of several key government institutions in Azerbaijan. Users have lost access to the information portals and electronic services of the country's most vital agencies. Network connection errors are displayed when attempting to open the websites.
Affected government entities include:
* Cabinet of Ministers of the Republic of Azerbaijan
* Ministry of Defense
* Ministry of Health
* Ministry of Economy, Ministry of Internal Affairs, and Ministry of Foreign Affairs
* Ministry of Science and Education, State Statistical Committee, and the Milli Majlis (Parliament).
Responsibility and Motives Behind the Attacks:
While official bodies are currently conducting restoration works, the situation completely mirrors the events of October 13–15. During that period, over 100 government domains, including websites of state authorities, media outlets, and foreign diplomatic missions, fell victim to a massive DDoS attack.
The pro-Iranian hacker group "313 Team" (Islamic Cyber Resistance in Iraq) officially claimed responsibility for the attack. The radicals stated their actions were a "protest" against Azerbaijan's domestic policies, specifically the introduction of a unified secular school uniform and the enforcement of regulations regarding religious attire in educational institutions.
According to investigations by the National CERT, the attackers are utilizing a commercial botnet service (such as Litterbox or Catbox), which is coordinated via Telegram channels. The service generates enormous volumes of malicious traffic using GRE, ICMP, UDP, and TCP protocols. Its main hazard lies in its ability to artificially distribute requests through bot networks across pre-selected countries, effectively bypassing standard geographic defense filters (Geo-IP blocking).

🔍 Timeline of the Escalating Threat (July – September)

The current large-scale infrastructure collapses are the result of a lengthy preparatory phase actively carried out by cybercriminals over the preceding three months.
* July – August: Reconnaissance and Vulnerability Scanning. According to reports from the Electronic Security Service, an anomalous spike in port scanning was detected within the Azerbaijani network segment mid-summer. Hackers identified government servers running outdated Database Management System (DBMS) software. Target lists for future attacks were compiled during this period.
* September: Information Campaign and Initial Breaches. Mass ideological coordination began within radical Telegram communities. Concurrently, attackers shifted to compromising user accounts, with defense systems detecting frequent brute-force attempts targeting administrative panels. A major issue was that system administrators had left default factory settings and credentials on some internal nodes.
* Outcome by Early October: Software vulnerabilities and weak password configurations accumulated and left unaddressed throughout July, August, and September allowed hackers to partially seize control of vulnerable internal servers. This enabled them to multiply the power of the DDoS attack from within, temporarily paralyzing the public availability of Azerbaijan's digital infrastructure in October.