Ishmael Kardryni
Introduction
There is still deep skepticism surrounding the 2022 alleged Iranian cyberattack against the Albanian government. Digital activists such as Mr. Gent Progni question the dominant attribution narrative. They ask whether the so-called Iranian hackers might be part of a constructed explanation rather than a fully proven forensic conclusion. Critics argue that investigators have not investigated the matter further, while international media outlets have not pursued the issue more critically. No fully convincing digital forensic analysis has been made publicly available beyond political and technical speculation. As IT expert Mr. Remion Bacova remarks in conversation with the author, Microsoft’s report (2022) reads more like a politically framed document than a purely forensic one, especially because it did not sufficiently address possible domestic technical failures, such as unpatched virtualization servers and poor infrastructure management.
These doubts should not be dismissed as mere conspiracy thinking. In Albania, many observers view the official attribution to Iran with suspicion. Some suspect that the attack may have been a false-flag operation, possibly orchestrated or facilitated locally in order to destroy evidence of corruption, discredit political opponents, or justify new cybersecurity contracts. The corruption scandal surrounding the National Agency for Information Society (AKSHI — Agjencia Kombëtare e Shoqërisë së Informacionit) gives this concern a far more concrete political basis. Albania’s National Agency for Information Society is the central administrative body responsible for e-government systems, public digital infrastructure, and major IT procurement. If corruption occurred around such an institution, it is legitimate to ask about motive, opportunity, and institutional accountability.
The Attack and the Official Attribution
In July and September 2022, Albanian government systems were severely compromised. The attackers reportedly maintained access for many months before deploying destructive malware, including wiper and ransomware components. Data was exfiltrated before the final destructive phase, indicating that the operation was not simply an opportunistic attack but a sustained and organized campaign.
Microsoft (2022), supported by assessments from the FBI, CISA, Mandiant, and the UK National Cyber Security Centre, attributed the operation to Iranian state-linked actors, particularly groups associated with Iran’s Ministry of Intelligence and Security. The attribution rested on several elements: infrastructure that had previously been used against targets of interest to Iran, malware components and certificates linked to earlier Iranian operations, and a clear geopolitical motive. Albania’s hosting of the Mujahedin-e Khalq, an Iranian opposition organization, gave Tehran a strong reason to target Albanian state institutions.
The timing and public messaging of the attack also fit this interpretation. The attackers destroyed systems, accompanied the operation with anti-MEK messaging, and released politically framed data leaks. This combination of technical disruption, symbolic communication, and geopolitical signaling is consistent with state-sponsored cyber operations.
The Case for Skepticism
However, there are reasons to be skeptical of the official narrative, especially given Albania’s geopolitical posture as an American ally. Cyber attribution is also inherently difficult. Attack tools, stolen certificates, wiper frameworks, and exploit kits can circulate on the dark web or be reused by different actors. A technically skilled local group, especially one with insider assistance, could theoretically imitate some elements of a foreign operation.
The possibility of insider facilitation is particularly important. A purely external local actor would likely have had limited capacity to conduct such a long and complex operation. However, if insiders provided credentials, ignored alerts, suppressed logs, or failed to patch critical vulnerabilities, the technical probability of local involvement rises considerably. In that scenario, the attack would no longer require a fully independent domestic hacking capability. It could instead rely on a mixture of external tools, internal access, institutional negligence, and political protection.
The false-flag hypothesis cannot be dismissed on technical grounds alone. The destructive phase of the attack, at least in principle, could be replicated by determined actors using publicly available or stolen tools. The real question, therefore, is not simply whether local actors could have carried out parts of the attack. The more important question is whether they had a motive strong enough to justify such a risky operation.
This is where the AKSHI corruption case becomes central. Earlier versions of the false-flag hypothesis often appeared weak because the alleged domestic motive — destroying corruption evidence or justifying cybersecurity contracts — remained too abstract. The AKSHI scandal changes this. It provides a concrete domestic corruption context around the very institution responsible for Albania’s digital infrastructure.
The AKSHI case is no longer merely a matter of public suspicion. It has entered the sphere of criminal investigation, documented evidence, asset seizures, and recorded or intercepted communications. Public reporting has described money stolen through manipulated tenders, suspicious transactions, hidden assets, and meetings or communications that allegedly reveal how procurement schemes operated.
This matters because AKSHI managed sensitive digital infrastructure, e-government systems, and major public IT procurement. If money was stolen through manipulated tenders, and if recorded meetings or intercepted communications document how such schemes operated, then the domestic motive for concealment becomes much stronger. A cyberattack on state digital systems could, under such circumstances, become politically convenient: it could destroy or compromise records, create confusion over missing data, shift public attention toward a foreign enemy, and justify further cybersecurity spending.
The corruption changes the analytical weight of the false-flag concern. If AKSHI activities were already compromised, then the possibility that domestic actors benefited from the attack, failed to prevent it, or used it to cover institutional misconduct deserves serious investigation.
Intelligence Assessment of Various Scenarios
The strongest argument against a purely local false flag remains the political messaging of the attack. A local operation designed primarily to destroy evidence of corruption would probably have been quieter, more selective, and less theatrical. It would likely have targeted specific databases, archives, or procurement records. Instead, the 2022 attack was highly visible, politically symbolic, and explicitly connected to anti-MEK messaging.
This matters because cyberattacks are not only technical events; they are also communicative acts. The Albanian attack was staged in a way that sent a message. The public leaks, the anti-MEK framing, and the timing around MEK-related tensions all align closely with Iranian interests. For a local actor to design such an operation as a full false flag, they would have needed not only technical access but also the strategic discipline to imitate Iranian motives, timing, messaging, and operational behavior over a long period.
However, the AKSHI corruption case complicates this conclusion. What seems to have been an opportunistic choice of target may have been a deliberate attempt to obscure the real objective: procurement records, backdoors to databases, and other illicit activities. This suggests that the false-flag question should not be framed only as “Iran or local actors?” A more realistic question is whether Iranian involvement and domestic institutional interests may have intersected. The attack may have been foreign in origin while still being enabled by Albanian negligence, insider weakness, corrupt procurement structures, or post-attack opportunism.
We may express our assessment in probabilistic terms. A sophisticated local actor, especially with insider assistance, could theoretically replicate parts of the attack. Long-term stealth (14 months) becomes far more plausible if a government IT insider provides credentials, suppresses alerts, or cleans logs. Purely external local actors have low technical capability, with probabilities of 10 to 20%. With insider facilitation, probabilities rise to 40–60%.
When we separate technical capability from motivation, the picture shifts significantly: Technical Probability (with insider help): 40–60% for local actors. Motivation Probability (corruption cover-up): only 15–30%.
Thus, a local false flag intended to destroy corruption evidence would likely have been quieter, more targeted, and less politically theatrical. Instead, the attackers used explicit anti-MEK messaging, leaked data with political framing, and timed the operation around MEK-related events. These elements align exceptionally well with Iranian motives (80–95% probability). Combined, the joint probability for a purely local false flag (even with insider help) falls to roughly 8–20%. Iranian state involvement remains the higher-probability scenario (65–85%).
In another scenario, the false-flag concern does not need to prove that Iran was absent. It can instead ask whether the Iranian attribution was used to close down uncomfortable domestic questions: Why were systems vulnerable for so long? Who benefited from the cybersecurity contracts that followed? Were procurement networks around AKSHI already compromised? Were logs, records, or databases relevant to corruption investigations lost or altered during the attack? And why has the Albanian public not been given a fuller independent forensic account? In this hybrid version, Iranian state-linked actors may have carried out the attack, while domestic corruption, negligence, or insider facilitation may have made the operation easier and its aftermath politically useful.
In this interpretation, the Iranian attribution may be technically valid but politically incomplete. It explains the external attacker, but not the internal conditions that allowed the attack to happen. It identifies a foreign adversary, but it does not explain why Albanian systems were vulnerable for so long, why institutional oversight failed, and whether corrupt procurement networks benefited from the crisis.
Such a hybrid interpretation avoids two analytical errors. First, it avoids reducing all skepticism to conspiracy theory. Second, it avoids replacing one simplified narrative with another. The issue is not whether Iran or domestic corruption alone explains the attack. The issue is whether foreign aggression, state weakness, insider negligence, and procurement corruption interacted in ways that have not yet been fully investigated.
Conclusion
In cyberspace, attribution is often opaque, and governments rarely release all forensic evidence. Public reports usually summarize findings rather than disclose full packet captures, memory dumps, raw logs, or intelligence sources. This creates an evidentiary gap between what institutions claim to know and what the public is able to verify.
In Albania, this gap is amplified by low trust in public institutions. When citizens already suspect corruption, political manipulation, and opaque procurement practices, a major cyberattack can easily be interpreted through the lens of domestic power struggles. The AKSHI case reinforces precisely this mistrust. If the agency responsible for digital governance is itself connected to proven corruption involving tenders, stolen money, hidden assets, and recorded communications, then the public will naturally ask whether the cyberattack was only a foreign assault or also a convenient domestic rupture.
The official attribution cannot fully resolve the political legitimacy problem. For many Albanians, the question is not only “Who carried out the attack?” but also “Who benefited from the attack, what evidence disappeared, and why has institutional accountability remained so limited?”
Thus, the AKSHI corruption scandal means that the domestic dimension can no longer be treated as a weak or conspiratorial afterthought. The deeper question is whether the attack also served domestic interests by covering up corruption, destroying or confusing evidence, redirecting public anger, and legitimizing new cybersecurity contracts.
For this reason, the Iranian attribution should not close the case. It should open a second investigation: into AKSHI, procurement networks, missing or altered digital records, post-attack cybersecurity contracts, and the possibility that foreign cyber aggression intersected with domestic corruption.
© 2026 Argumentum
