Operation Silent Watch: Desktop Surveillance in Azerbaijan and Armenia

Executive summary

Amid rising tensions between Azerbaijan and Armenia over the Lachin corridor in late 2022, Check Point Research identified a malicious campaign against entities in Armenia. The malware distributed in this campaign is a new version of a backdoor we track as OxtaRAT, an AutoIt-based tool for remote access and desktop surveillance.

Key findings:

• The newest version of OxtaRAT is a polyglot file, which combines compiled AutoIT script and an image. The tool capabilities include searching for and exfiltrating …

access armenia autoit azerbaijan backdoor campaign check check point desktop distributed entities executive findings key malicious malware point polyglot remote access research rising rising tensions script silent surveillance tool version watch