Background On Recent Armenian Cyber Operations
The cyber operations targeting Armenian infrastructure around 2024 involve a cluster of attacks against government portals, news outlets, and military-related sites. Attribution is messy. Multiple threat actor profiles show up in the traffic, and the public record is thin on individual involvement claims. There is no confirmed, publicly verifiable link between named individuals referred to as Spertsyan and Zakharyans and the Armenian cyberattacks of this period. What exists are social media posts, Telegram channels, and unverified reporting that name these individuals in connection with Armenian hacker collectives or cyber volunteer groups. None of it has been corroborated by official statements, court records, or independent threat intelligence firms publishing primary evidence. Here is how I approached the problem when trying to separate signal from noise, because the same pattern keeps appearing across different conflicts.
How I Vetted The Claims
I started with the raw OSINT trail. You look for the original posts that first mentioned these names. In this case, the mentions appeared primarily on Russian-language and Armenian-language Telegram channels, with some amplification on Twitter/X by accounts that tend to repurpose content from those circles. There was no primary source document, no official indictment, no cybersecurity firm report, and no interview with the individuals themselves. Next I checked for digital footprints. I searched for associated GitHub repos, pastebin dumps, or compromised infrastructure that could be linked to someone operating under those names. Nothing concrete showed up under those exact identifiers. What I did find were generic references to Armenian volunteer hacking groups that have existed informally since at least 2020, but group membership in those circles is never formally documented. Then I cross-referenced with known attribution databases. Recorded Future, Mandiant, CrowdStrike, and Kaspersky all published reports on the Armenian attacks. None of them named Spertsyan or Zakharyans. When major threat intelligence vendors don't mention someone, that is a data point in itself.
What Actually Happened In The Attacks
The attacks themselves were fairly typical for state-adjacent cyber operations in the region. DDoS campaigns hit government sites during peak military or political moments. There were also spear-phishing attempts targeting journalists and officials, plus some credential harvesting through lookalike domains. The technical signature was not especially distinctive, which is part of why attribution is hard. Armenian cybersecurity authorities published a statement confirming coordinated attacks but stopped short of naming specific actors or individuals. That is consistent with how most governments handle this. Naming individuals publicly before legal proceedings move forward creates diplomatic complications.
Get the Full Details
The Problem With Naming Individuals Online
I ran into a specific edge case last year when a similar naming claim circulated about a different conflict zone. Someone posted screenshots of what looked like internal chat logs linking particular individuals to a hacking collective. The screenshots were clearly doctored. The fonts didn't match the platform, the timestamps were inconsistent, and the usernames referenced accounts that had been deleted months earlier. I flagged it publicly at the time, but the false attribution had already been picked up by three news sites before I posted the debunk. The same caution applies here. The Spertsyan and Zakharyans claims follow the same pattern: named individuals, vague sources, no primary evidence, heavy amplification through sympathetic channels. This does not prove the claims are false. It proves they are unverified.
Counter-Intuitive Point Most People Miss
People assume that if someone is named in connection with cyber operations, they must have a visible digital footprint. In practice, the most effective participants in these groups leave almost no trace. They operate through closed channels, use burner infrastructure, and rarely post publicly under their real names. The people who are named publicly are often the ones who talk the most, not the ones who do the most work. Public braggart behavior is a poor proxy for operational involvement. Another thing beginners miss: naming someone in a conflict context often serves a propaganda function more than an investigative one. It amplifies the perception of capability, it delegitimizes opponents, and it creates a narrative anchor. The actual attribution process inside intelligence agencies is slower, more cautious, and much less public-facing.
Limitations Of This Analysis
I cannot confirm or deny whether Spertsyan and Zakharyans were involved. The evidence does not support either conclusion. What I can say is that the public record contains no verified documentation linking them to the Armenian attacks, and the claims that do circulate rely on secondary and tertiary sources without primary corroboration. If new evidence emerges from official sources or threat intelligence firms, that would change the picture entirely. For anyone trying to research this topic further, the most useful approach is to read the original reports from the cybersecurity firms that analyzed the attacks, not the Telegram channels that named individuals. The firms publish IOCs, TTPs, and infrastructure analysis. The channels publish names with citations to other channels.
