Security researchers and digital rights organisations have raised concerns about the government of Azerbaijan allegedly using Pegasus spyware developed by NSO Group to target individuals in Armenia, including government workers, journalists, activists, and the human rights ombudsperson. The attacks occurred between November 2021 and December 2022, coinciding with the long-standing Nagorno-Karabakh conflict between Armenia and Azerbaijan, which experienced heightened tensions and military actions in May 2021. The cases were investigated by Access Now, Citizen Lab, Amnesty International, CyberHUB-AM, and local cybersecurity researchers.

Access Now stated that the victims' phones were infected shortly after sharing contact details with counterparts in Azerbaijan. While there is no definitive evidence linking the Azerbaijan government to the cyberattacks, the Pegasus Project, a coalition of media organisations, revealed that the country is an NSO Group customer. However, some victims speculated that the Armenian government could be responsible due to their criticism of local authorities at the time.

Access Now believes that these cyberattacks may be the first public instances where commercial spyware was employed within the context of a war.

The use of such spyware in the context of an armed conflict raises questions regarding its compliance with international law. While peacetime espionage is generally criminalised at the national level, there is no specific provision within international law regarding its application during armed conflicts. The legality of intelligence activities conducted by belligerent parties' armed forces in uniform is generally acknowledged. However, the use of commercial spyware in this context presents complex legal considerations.

The Azerbaijani embassy in Washington D.C. and NSO Group did not respond to requests for comment, while the Armenian embassy in Washington D.C. did not provide a comment when approached on the matter.