Weaponizing Armenia’s National Security Brand Against the Diaspora

It starts with a single, polite page in Armenian.

“Dear colleagues, to review the information in the attached PDF file, double-click the button below to view the attachments. Respectfully, National Security Service of the Republic of Armenia.”

Below the text sits a crisp blue button labeled VIEW FILES, accompanied by a helpful technical note: for best results, open this document in Adobe Acrobat Reader.

To anyone working within Armenian civil society, diaspora organizations, or international policy circles, the document—titled “Hovel Chernokian SNS CASE for Armenian Diaspora”—looks intriguing enough to click. Behind that blue button lies a multi-layered espionage operation analyzed by CyberHUB-AM in late September 2026. By combining state-authority impersonation, the stolen personal resumes and passport scans of real Armenian diaspora professionals, and a custom-built PowerShell surveillance implant, the attackers aren’t just looking to steal a password. They are turning the victim’s screen into a live feed—and using their computer as a bridgehead to tunnel deeper into their organization’s internal network.

📥 Download the Full Technical Report (PDF) — Ref: CHAM-IN-2026-09-28

For security teams, SOC analysts, and threat researchers: Download our full 7-page technical report containing complete SHA-256/MD5 file hashes, decryption vectors, MITRE ATT&CK mappings, and host/network Indicators of Compromise (IoCs).

The Psychology of the Lure: Exploiting Institutional Trust

For researchers tracking Foreign Information Manipulation and Interference (FIMI) and hybrid threats in the South Caucasus, the social engineering in this campaign is quite obvious.

Impersonating the NSS accomplishes two objectives simultaneously. First, it exploits deference to state security authority—creating an immediate sense of urgency that bypasses normal skepticism. Second, it corrodes trust. When diaspora networks and civil society organizations are targeted with malware dressed up as official Armenian state correspondence, the secondary effect is friction and suspicion between the diaspora and institutions in Yerevan.

Once the target opens the PDF in Adobe Acrobat and clicks the blue button, a tiny snippet of embedded JavaScript (this.exportDataObject) quietly triggers. This is why the attackers insisted on Acrobat Reader: most modern web browsers block PDF JavaScript out of the box, whereas Acrobat supports the exact function needed to unpack an archive hidden inside the PDF.

Out drops a file named NSS_FILES_Diaspora.rar, padded at the very end with an invisible zero-width space character (U+200B) designed to slip past automated email and file-extension filters.

Stolen Lives as Window Dressing

Inside the archive sit four files: two genuine-looking CVs (one in PDF format, one in Europass Word format), a scan of an identity document, and a fourth file named after an individual with -PDF- wedged into the title—followed by a .exe extension.

The CVs and identity documents are clean; they contain no macros or malicious code. Instead, they belong to real diaspora-linked professionals with ties to the UAE, Iran, and Armenia—likely harvested from an earlier breach or an organizational registration database. By bundling real people’s paperwork into a “case file,” the attackers build an air of authenticity while turning previous victims’ personal data into bait for the next target.

When the user clicks the fourth file—expecting another PDF resume—they actually trigger a digital Russian nesting doll.

The Digital Nesting Doll: Two Stages, One Password

The fake PDF is a WinRAR self-extracting archive (SFX). The moment it is double-clicked, it performs a classic magician’s sleight of hand: it immediately opens a clean, genuine PDF resume on the victim’s screen so nothing looks amiss.

Behind the scenes, however, it extracts a second, password-protected WinRAR archive into the Windows temporary folder and unlocks it using a hardcoded password: VOVA—the traditional Russian diminutive for the name Vladimir.

Whether VOVA is a genuine operational slip by a Russian-speaking developer or a deliberate false flag planted to mislead threat analysts remains an open question. What is clear from internal file timestamps is that the attackers didn’t build this toolkit overnight. While the final loader was freshly compiled on September 19, 2026—just days before the lure was deployed—the underlying persistence scripts date back to early June 2026, pointing to a toolkit that has been quietly maturing for months.

To stay invisible on the victim’s machine, this second stage drops a legitimate copy of the AutoIt3 scripting interpreter alongside an obfuscated batch script (a.cmd) into the user’s %APPDATA%\deploy_my\ directory. Using legitimate software (a technique known as “Living off the Land”) allows the malware to set up two interlocking Windows Scheduled Tasks—named GRE and GRELK—without ever flashing a suspicious black command-prompt window on the user’s screen.

GRE runs every 3 minutes, launching the encrypted PowerShell spyware using the VOVA key.
GRELK runs every 29 minutes, acting as a ruthless watchdog. If the spyware hangs or stalls, GRELK forcefully kills the process so that GRE can cleanly resurrect it three minutes later.

Inside the Implant: A Camera Over Your Shoulder

Once decrypted in memory through an AES-CBC cipher and multiple layers of base64 encoding, the final PowerShell implant gets to work.

Every 10 to 20 seconds, the backdoor captures a screenshot of the victim’s desktop and ships it off to a command-and-control (C2) server located at conference.sources-debian[.]info—a domain registered over two years ago and carefully named to blend into network logs as a harmless Linux software mirror.

At 10-second intervals, screenshot capture stops being mere periodic reconnaissance and becomes near-continuous video surveillance. Every Signal or WhatsApp message read on desktop, every sensitive grant document opened, and every password typed on screen is captured in real time.

Beyond watching the screen, the implant polls the server for nine distinct operator commands that allow the attackers to:

Sweep and Exfiltrate: Search for specific filenames or mass-download entire directories of documents.
Stage and Split: Pull down 7-Zip from the attacker’s server, compress large folders into 2 MB chunks, and quietly upload them.
Pivot Inside the Office: Download an internal port-scanning script (scan.ps1) to map out other computers, servers, and printers on the victim’s local Wi-Fi or office network.
Open a Backdoor Tunnel: Fetch plink.exe (a legitimate command-line SSH tool) to establish a reverse SSH tunnel—effectively giving the attackers a direct pipeline from their remote server right through the organization’s firewall.

How to Protect Yourself and Your Organization

This campaign does not rely on a million-dollar “zero-day” software flaw. It relies on human curiosity, institutional authority, and a feature in Adobe Acrobat that almost no everyday user actually needs.

For Civil Society, Journalists, and Diaspora Organizations:

Remember how state agencies actually work: Neither the NSS nor legitimate law enforcement bodies send confidential case files via unsolicited PDFs that require you to click an embedded “View Files” button to unpack a .rar archive.
Turn off JavaScript in Adobe Acrobat Reader: Open Acrobat Preferences → select JavaScript → uncheck Enable Acrobat JavaScript. This single step completely neutralizes the lure mechanism used in this attack.
Show file extensions on Windows: In Windows File Explorer, go to View → Show → File name extensions. A file named SarkisBelian-PDF-63DA.exe is much easier to spot when Windows doesn’t hide the .exe at the end.

For IT Administrators and Security Teams:

Block and Retro-Hunt: Immediately block conference.sources-debian[.]info (and the parent domain sources-debian[.]info) across DNS, proxy, and firewall layers. Search proxy and DNS logs going back to June 2026 for any connections to this domain or requests using the anomalous User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/138.0 (note the mismatched rv:134.0 and Firefox/138.0 version numbers).
Hunt for Host Artifacts: Audit endpoints for the %APPDATA%\deploy_my\ directory, scheduled tasks named GRE or GRELK, and executions of AutoIt3.exe or curl.exe -k originating from user-writable directories.
Assume Full Compromise on Hit: Because the implant takes screenshots every 10–20 seconds and supports reverse SSH tunneling, simply deleting the folder is not enough. Isolate the machine, preserve forensic images, rotate all credentials from a clean device, and audit internal network logs for lateral movement.

Download the Full Report & Get Support

📥 Download the Full Technical Report (PDF) — Ref: CHAM-IN-2026-09-28

(Includes complete SHA-256 and MD5 indicator tables, AES decryption parameters, SFX script artifacts, and full MITRE ATT&CK matrix).

Suspect you’ve received this file or a similar lure?

If you are a member of Armenian civil society, independent media, a human rights defender, or a diaspora organization and have received a suspicious document, do not open or forward it over unencrypted channels. Contact the CyberHUB-AM rapid-response team immediately for free, confidential digital security assistance and forensic analysis.