Author: Boshkezenian Garik

THE HAGUE, Netherlands — The United Nations’ highest court ordered Azerbaijan on Wednesday to “take all steps at its disposal” to allow free movement of traffic along the only road between Armenia and the ethnic Armenian Nagorno-Karabakh region in Azerbaijan that has been blocked by protesters in a move that has further fueled tensions between the two countries.

The legally binding 13-2 ruling by the International Court of Justice results from the latest legal skirmishes in a long-running feud between Armenia and Azerbaijan over Nagorno-Karabakh. Each country filed a case with the court accusing the other of breaching a convention aimed at stamping out racial discrimination.

Wednesday’s ruling on the blocked road known as the Lachin Corridor came just over two years after the neighboring nations ended a war in Nagorno-Karabakh that killed about 6,800 soldiers and displaced around 90,000 civilians.

The remote and rugged region is within Azerbaijan but had been under the control of ethnic Armenian forces backed by Armenia since the end of a separatist war in 1994.

A cease-fire brokered by Russia ended the 2020 war and granted Azerbaijan control over parts of Nagorno-Karabakh as well as adjacent land occupied by Armenians. Russia sent a peacekeeping force of 2,000 troops to maintain order, including controlling the Lachin Corridor.

Armenia’s lawyers said during court hearings last month that the roadblock set up late last year by protesters claiming to be environmental activists was part of an Azerbaijani campaign the Armenians labeled “ethnic cleansing.”

International Court of Justice President Joan E. Donoghue said the evidence presented by Armenia established that the blockade “has impeded the transfer of persons of Armenian national and ethnic origin hospitalized in Nagorno-Karabakh to medical facilities in Armenia for urgent medical care.”

It also interrupted supplies to Nagorno-Karabakh of “essential goods causing shortages of food, medicine and other lifesaving medical supplies,” Donoghue said.

In their majority decision, the court’s judges ordered Azerbaijan to “take all measures at its disposal to ensure unimpeded movement of persons, vehicles and cargo along the Lachin Corridor in both directions.”

In a statement, Azerbaijan’s Ministry of Foreign Affairs said the court’s ruling “took note of Azerbaijan’s representation that Azerbaijan has and undertakes to continue to take all steps within its power and at its disposal to guarantee safe movement along the Lachin road.”

The statement said Azerbaijan “will continue to uphold the rights of all people under international law and to hold Armenia to account for its ongoing and historic grave violations of human rights.”

The court, in its ruling, said that Armenia’s request for judges to order Azerbaijan to “cease its orchestration and support” of the protests on the Lachin Corridor was “not warranted.”

The judges rejected Armenia’s request for an order for Azerbaijan not to block gas supplies to Nagorno-Karabakh, saying that Armenian lawyers did not provide enough evidence to back their claim that Azerbaijan was disrupting the supply.

The judges also declined a request by Azerbaijan for an order to stop or prevent Armenia from laying landmines and booby traps in areas of the region to which Azerbaijani citizens are to return.

The world court ordered both nations a little over a year ago to prevent discrimination against one another’s citizens in the aftermath of the war and to not further aggravate the conflict.

Entities in Armenia have come under a cyber attack using an updated version of a backdoor called OxtaRAT that allows remote access and desktop surveillance.

“The tool capabilities include searching for and exfiltrating files from the infected machine, recording the video from the web camera and desktop, remotely controlling the compromised machine with TightVNC, installing a web shell, performing port scanning, and more,” Check Point Research said in a report.

The latest campaign is said to have commenced in November 2022 and marks the first time the threat actors behind the activity have expanded their focus beyond Azerbaijan.

“The threat actors behind these attacks have been targeting human rights organizations, dissidents, and independent media in Azerbaijan for several years,” the cybersecurity firm noted, calling the campaign Operation Silent Watch.

The late 2022 intrusions are significant, not least because of the changes in the infection chain, the steps taken to improve operational security, and equip the backdoor with more ammunition.

The starting point of the attack sequence is a self-extracting archive that mimics a PDF file and bears a PDF icon. Launching the purported “document” opens a decoy file while also stealthily executing malicious code hidden inside an image.

A polyglot file that combines compiled AutoIT script and an image, OxtaRAT features commands that permit the threat actor to run additional commands and files, harvest sensitive information, perform reconnaissance and surveillance via a web camera, and even pivot to other.

OxtaRAT has been put to use by the adversary as far back as June 2021, albeit with significantly reduced functionality, indicating an attempt to constantly update its toolset and fashion it into a Swiss Army knife malware.

The November 2022 attack also stands out for a number of reasons. The first is that the .SCR files that activate the kill chain already contain the OxtaRAT implant as opposed to acting as a downloader to fetch the malware.

“This saves the actors from needing to make additional requests for binaries to the C&C server and attracting unnecessary attention, as well as hides the main malware from being easily discovered on the infected machine, as it looks like a regular image and bypasses type-specific protections,” Check Point explained.

The second striking aspect is the geofencing of command-and-control (C2) domains that host the auxiliary tools to Armenian IP addresses.

Also of note is the ability of OxtaRAT to run commands for port scanning and to test the speed of an internet connection, that latter of which is likely used as a way to hide the “extensive” data exfiltration.

“OxtaRAT, which previously had mostly local recon and surveillance capabilities, can now be used as a pivot for active reconnaissance of other devices,” Check Point said.

“This may indicate that the threat actors are preparing to extend their main attack vector, which is currently social engineering, to infrastructure-based attacks. It also might be a sign that the actors are moving from targeting individuals to targeting more complex or corporate environments.”

“The underlying threat actors have been maintaining the development of Auto-IT based malware for the last seven years, and are using it in surveillance campaigns whose targets are consistent with Azerbaijani interests.”