Russia’s Cyberwarfare: How GRU Targeted Azerbaijan

From Sofia to Syria, a tale of fake leaks, forged documents, and one target: Azerbaijan.

It began with a story that seemed explosive. In 2017, a Bulgarian journalist claimed that Azerbaijan was secretly delivering weapons to Syrian terrorists aboard diplomatic flights.

Dilyana Gaitanjieva’s report said 350 Silkway Airlines flights had carried arms to conflict zones across Syria, Afghanistan and Africa, using diplomatic immunity as cover.

The story was quickly amplified. Shared by WikiLeaks, endorsed by Julian Assange, and circulated by pro-Kremlin media, it appeared to reveal a hidden network of Western governments, Gulf states and Azerbaijan fuelling foreign wars.

But there was a problem. None of it was true.

In 2025, a detailed investigation by The Insider uncovered the real source behind the leak. It wasn’t a whistleblower, but a fabricated Twitter account created by Russia’s military intelligence, GRU Unit 29155.

This same unit had already been linked to poisonings in Europe, sabotage operations and cyberattacks. Now, it was tied to disinformation.

The flight documents, diplomatic notes and weapons manifests that Gaitanjieva had received were either forged or deliberately manipulated. They were sent to her directly from the GRU-controlled account.

It was a strategic operation. The goal was not just to harm Azerbaijan’s image, but to undermine NATO, stir distrust in Western institutions, and shift blame away from Russia’s actions in Syria.

The Silkway story became a case study in modern propaganda. It followed a clear pattern, a fake narrative, pushed through a real journalist, then broadcast to the world by state media.

And it worked. Azerbaijan became entangled in a lie carefully constructed to look like the truth.

There was enough evidence to name Gaitanjieva directly. For years, her motivations were debated. Some believed she was misled. Others thought she was ideologically driven.

But investigators found direct communication between her and members of the GRU dating back to 2016. By mid-2017, the collaboration was already active.

After her dismissal, she joined pro-Kremlin media platforms, appeared at Russian state-sponsored events, and promoted new conspiracy theories, including claims about secret US-run biolabs in Ukraine.

In 2023, Ukraine’s security service listed her as a probable GRU asset. Her name appeared in the Mirotvorets database.

Though recent communication seems to have stopped, the impact of the disinformation campaign remains.

This was not just another cyberattack. It was a narrative, shaped and sharpened to cut through truth. It used forged evidence, real headlines, and willing amplifiers.

And Azerbaijan, despite having no proven link to the arms transfers, became the face of a scandal built on fiction.

The Silkway Airlines hoax was not the most violent GRU operation. But it was among the most effective.

Because it didn’t just target governments. It targeted perception.

The headlines may be gone. The story may be forgotten by some. But the damage lingers — in reputation, in trust, and in the silence that followed.

For journalists, it is a lesson in how truth can be engineered.
For states like Azerbaijan, a reminder of how narratives can be turned into weapons.
And for the world, a quiet warning.

Not all propaganda shouts.
Some walk in softly, wearing footnotes and flight logs, carried not by planes, but by belief.

Tags

News GRU UNIT Syria leak Fakenews