Ahead of Armenia’s parliamentary elections scheduled for 7 June, reports of various hybrid attacks have become more frequent. Information security expert Samvel Martirosyan has analysed the activity of two Telegram channels in particular: Armenian Code and Wolves of Turan. He says the same team operates both platforms, despite their apparent rivalry. He adds that their attacks target Armenia.

Martirosyan says he sees a coordinated hybrid attack against Armenia. He does not view as coincidental a statement by Wolves of Turan claiming that it launched “mirror actions” against critical Armenian online platforms “in response to attacks by the Armenian Code team” on Turkish and Azerbaijani websites.

The media expert argues that the motive is to create artificial grounds for a “cyber war” that serves specific geopolitical goals.

We are publishing a translation of Samvel Martirosyan’s article.

---

• ‘An army of fake accounts backs one of the prime ministerial candidates,’ Armenian fact-checkers say
• Poll: Will Armenia’s ruling party win June election?
• Opinion: ‘Russia has far more leverage over Armenia than over Moldova’

---

Article by information security expert Samvel Martirosyan

“As the June 2026 Armenian parliamentary elections approach, a sophisticated hybrid operation with the signs of cyberactivities, attacks against critical infrastructure and Foreign Information Manipulation and Interference (FIMI) operation has emerged in the digital shadows.

Two supposedly rival hacking groups — Armenian Code and Wolves of Turan — have appeared on Telegram, engaging in a performative “tit-for-tat” conflict that OSINT analysis suggests is a single, coordinated campaign designed to destabilize the region.”

In reality, a single unknown team stands behind the two supposedly opposing hacking groups and carries out the same external operation. Its members most likely speak neither Armenian nor Turkish, but Russian.

Digital twins generated from a single source

While these groups claim to represent opposing nationalist interests, their infrastructure reveals a synchronized birth:

• Infrastructure Mirroring: Both groups registered their channels on the Russian analytical platform TGStat within 24 hours of each other. TGStat analytical platform with a difference of 24 hours.
• Coordinated Launch: Armenian Code (AC) was created on January 14, 2026. Just five days later, on January 19, the “rival” Wolves of Turan (WoT) emerged. AC channels on Telegram: Eng — @armeniancode_eng , Arm — @armeniancode_am. WoT channels on Telegram:Eng: @Wolves_of_Turan_eng. Tr — @Wolves_of_Turan

Armenian Code in TGStat Wolves of Turan in TGStat

Visual and Structural Identity: Both groups operate identical English-translation bot structures and post formatting.

Hackers usually rely on third-party websites to provide objective proof of successful attacks. They create a separate link for each attack, confirming that it targeted a specific website at a specific time.

The Armenian Code and Wolves of Turan channels use the same website for this purpose, which is notable in itself. An even more telling detail suggests both channels share the same administrator. At one point, the common admin accidentally posted identical links on both supposedly opposing channels.

check-host.net/check-report/3d35ec43kb85
check-host.net/check-report/3d35ee5dk6e6
check-host.net/check-report/3d35ed41kc29

In this case, the manipulators became victims of their own tactics and accidentally posted the same links.

Linguistic Fingerprints: The “Russian” Syntax

Despite their posturing as Armenian and Turkish patriots, linguistic analysis by multiple LLMs (Gemini, ChatGPT, Grok) has identified significant markers of Russian-language thought patterns in their English content.

Translation Artifacts: The groups use specific calques (direct word-for-word translations) that are common in Russian political discourse but rare in native Armenian or Turkish digital culture.

Calques from Russian: Literal, slightly awkward English idioms that strongly suggest translation from Russian: “sit idly by with folded arms”, “absorbed it with our mothers’ milk”, “piece by piece”, “we will not miss a single attack and we will take revenge!”, “the call of blood”.

Cyrillic Artifacts: In AC post, the text says: opposition party “Hayk” (Ayakwe). The inclusion of the Cyrillic spelling Ayakwe next to the name strongly suggests the original draft was written in a Cyrillic-based script (likely Russian, as “Hayk” is an Armenian name, but the transliteration provided is Russian phonetics. And the real name of the political party is Hayaqve, not Hayk: this also shows automated translation without going deep into details by the unknown operator).

From Noise to Kinetic Impact: The April Escalation

In April 2026, the operation transitioned from information warfare to high-impact DDoS and SCADA attacks.

• Financial Sabotage: Wolves of Turan claimed responsibility for a “collapse of payments” in Armenia, successfully targeting Armenian largest banks, payment systems, insurance companies etc.
• Infrastructure Manipulation: Both groups claim to have accessed SCADA systems to manipulate water reservoirs, heating boilers, and irrigation systems in Baku and Yerevan.

A “Professional” Signature: The ability of a three-month-old “activist” group to paralyze national financial nodes and manipulate industrial control systems suggests state-sponsored or professional mercenary capabilities.

Conclusion: A Manufactured Crisis

The “Armenian Code” and “Wolves of Turan” are not enemies; they are two hands belonging to the same body. By manufacturing a “cyberwar,” the threat actor achieves several geopolitical goals in it`s false-flag operation:

1. Economic Disruption: Eroding trust in Armenian banking and fintech stability, state and security institutions.
2. Political Polarization: operation designed to inflame the Armenia–Turkey/Azerbaijan cyber (or broader) conflict before the June elections..

In the world of modern hybrid warfare, the most dangerous enemy is the one that pretends to be your own defender while secretly typing from the same room as your “attacker.”

Armenia is represented at the diplomatic forum in Antalya, held on 17–19 April, by Deputy Foreign Minister Vahan Kostanyan. Foreign Minister Ararat Mirzoyan did not travel to Turkey.

For the first time since the Armenia–Turkey normalisation process began in 2022, Mirzoyan is not attending the forum. Armenia’s special envoy for normalisation with Turkey and Deputy Speaker of parliament Ruben Rubinyan, who attended in 2024 and 2025, also did not go to Antalya.

“I will not go to Antalya. I am not going to travel there every time,” Rubinyan told journalists.

Officials in Yerevan have not commented on the lower level of representation. However, experts say the Armenian side is signalling discontent. They link this to Turkey’s failure to implement agreements reached between the two countries. This includes opening the Armenia–Turkey border to third-country nationals and holders of diplomatic passports.

“If Turkey does not take this small step, what is there for the foreign minister to do there?” said Turkologist Nelli Minasyan.

She also says that Turkey’s president will not attend the European Political Community summit in Yerevan in May. Leaders from dozens of countries are expected to take part.

“They say [Foreign Minister Hakan] Fidan may come. But this is not a meeting of that level. The president’s participation is what matters,” Minasyan said.

---

• ‘On security, we are in the same boat’: Armenian experts on visit to Azerbaijan
• ‘Battle for scandal-loving voters’: Armenia’s pre-election mood
• Opinion: ‘Russia ‘blackmails’ Armenia with threat of gas price hikes’

---

“The ball is not on our side”

Armenia’s special envoy Ruben Rubinyan recently commented on the normalisation process with Turkey. He said he sees some progress. He also stressed that the key agreement concerns opening the border to third-country nationals and holders of diplomatic passports.

“We have done everything we could. I mean the reconstruction of the Margara checkpoint on the Armenian side. The good news is that the Turkish side has started work this year to restore the Alican checkpoint. We are now waiting for the agreement to be implemented. In this respect, the ball is not on our side,” he said.

Context: what Armenia and Turkey’s envoys have agreed so far

In December 2021, Yerevan and Ankara announced their readiness to take steps towards normalising relations. They appointed Ruben Rubinyan and Serdar Kilic as special envoys to coordinate the process. Since 2022, the two have held six meetings. Four took place abroad, one at the Armenia–Turkey border, and the latest in Yerevan. After each meeting, both sides said they would continue dialogue without preconditions.

At a meeting in Yerevan in September 2025, the sides agreed to speed up implementation of an earlier deal reached in July 2022. This concerned opening the Armenia–Turkey border to third-country nationals and holders of diplomatic passports.

During their latest meetings, Rubinyan and Kilic also agreed to:

• conduct technical studies to restore and relaunch the Gyumri–Kars railway and a power transmission line,
• assess technical needs and ensure the operation of the Akhurik/Akyaka railway border crossing,
• mutually simplify visa procedures for holders of diplomatic and service passports.

So far, only the agreement on simplifying visa procedures has been implemented.

Comment

Turkologist Nelli Minasyan welcomed Armenian Foreign Minister Ararat Mirzoyan’s decision not to attend the forum in Antalya.

“The two countries reached agreements that the Turkish side has simply not implemented. There is no point for our foreign minister to travel there again,” she said.

In her view, Yerevan is using this move to signal its dissatisfaction.

Minasyan also argues that Ankara prioritises broader regional developments in its foreign policy. Issues related to the border with Armenia do not rank high on its agenda.

At the same time, she says unblocking infrastructure matters for Turkey as well. She does not rule out a shift in Ankara’s priorities once “the United States makes a final decision on TRIPP, and work and investment begin.”

Nelli Minasyan suggests that the failure to implement the agreements stems from a lack of political will on Turkey’s part, as well as the Azerbaijani factor, meaning coordination of decisions on Armenia with Azerbaijan.

“In Azerbaijan, there are concerns that Armenia–Turkey relations could normalise more quickly, and that they could develop more naturally and positively across various issues,” the expert says.

In any case, she считает more realistic the prospect of normalisation with Yerevan after Armenia and Azerbaijan sign a peace treaty. According to her, Baku expects no progress in Armenia–Turkey normalisation before such an agreement is reached.

“Several months ago, Hakan Fidan set out Ankara’s official position: once the agreement is signed, the Armenia–Azerbaijan and Armenia–Turkey borders will open simultaneously. In my view, this is a realistic approach.”