# Albanian AI Research - Diella System
## OSINT Investigation

**Target:** Diella - Albania's AI Minister
**Research Date:** January 25, 2026
**Status:** Active Investigation

---

## Quick Summary

**Diella** is the world's first AI system appointed to a cabinet-level government position. Developed by AKSHI (Albania's IT agency) using Microsoft Azure + OpenAI, it serves as Albania's "Minister of State for Artificial Intelligence."

**Critical Finding:** The agency that built Diella (AKSHI) was compromised by Iranian hackers in 2022 and its leadership was arrested for corruption in December 2025.

---

## File Structure

```
Albanian AI/
├── README.md                          <- This file
├── Diella.md                          <- Background research on Diella
└── FINDINGS/
    ├── OSINT_REPORT.md                <- Full technical OSINT report
    ├── exposed_assets.md              <- Publicly accessible assets
    ├── infrastructure.txt             <- IP addresses, tech stack
    ├── subdomains.txt                 <- AKSHI subdomain enumeration
    ├── data_breaches.md               <- Albania's data breach history
    ├── akshi_corruption.md            <- AKSHI leadership arrests (Dec 2025)
    └── iranian_cyberattacks.md        <- HomeLand Justice attacks & leaks
```

---

## Critical Findings

### 1. AKSHI Leadership Arrested (December 2025)
- **Director General Mirlinda Karçanaj** - Under house arrest
- **Deputy Director Hava Delibashi** - Under house arrest
- **Charges:** Structured criminal group, tender manipulation
- **Irony:** AKSHI built Diella to "fight corruption"

### 2. Iranian Cyberattacks (2022-2024)
- **Actor:** HomeLand Justice (Iranian state-sponsored)
- **AKSHI directly compromised**
- **Leaked via Telegram:**
  - 100,000+ police suspect records
  - Minister emails (Interior, Defense)
  - PM Rama's correspondence
  - Intelligence agency employee data
  - Citizen phone numbers & IDs
- **Claimed:** 2 petabytes deleted, 100TB exfiltrated

### 3. Historical Data Breaches
- **April 2021:** 910,000 voter records leaked
- **December 2021:** 637,138 salary records leaked (22% of population)
- Both linked to internal infiltration

---

## HomeLand Justice Telegram Channels (STILL ACTIVE)

| Channel | Members | Status |
|---------|---------|--------|
| @justice_homeland | 13.6k | Active |
| @JusticeHomeland1 | Unknown | Claimed official |

**Websites:**
- justicehomeland.ru (Russian domain)
- justicehomeland.org

**Data sources mentioned:** E-Albania, TIMS, Memex, Deep Sea, Credins Bank, AMC

---

## Infrastructure

| Asset | IP/URL | Notes |
|-------|--------|-------|
| e-albania.al | 134.0.39.39 | Main platform (ASP.NET) |
| akshi.gov.al | 134.0.42.170 | Agency site (WordPress) |
| AIBOT Frontend | proud-coast-026495803.4.azurestaticapps.net | Diella UI (Vue.js) |

### Technology Stack
- **AI/LLM:** OpenAI via Microsoft Azure
- **Frontend:** Vue.js 3.5 / Quasar Framework
- **Backend:** ASP.NET (e-Albania), WordPress (AKSHI)
- **Auth:** Keycloak (internal)
- **Database:** Hasura GraphQL (internal)

---

## Security Assessment

### Current Status
- WordPress API locked (401 auth required)
- WAF blocks sensitive files
- User enumeration disabled
- No new credentials exposed via passive OSINT

### Historical Compromise
- AKSHI systems breached by Iranian hackers (2022)
- Initial access gained 14 months before attack
- Web shells deployed: `pickers.aspx`, `error4.aspx`, `ClientBin.aspx`
- ROADSWEEP ransomware + ZeroCleare wiper used

---

## The 83 AI "Children"

PM Edi Rama announced Diella is "pregnant with 83 children" - AI assistants for each ruling party MP:
- Record all parliamentary sessions
- Take notes on proceedings
- Advise MPs on legislation votes
- Expected operational: End of 2026

---

## Key Questions

1. **Trust:** Why should citizens trust an AI built by a compromised, corrupt agency?
2. **Data Integrity:** Is Diella's training data secure given AKSHI's breach history?
3. **Oversight:** Who monitors an AI that's supposed to monitor corruption?
4. **Security:** Have vulnerabilities from 2022 breaches been fully remediated?

---

## Sources

### News & Analysis
- [TIME - Albania's AI Minister](https://time.com/7324934/albania-ai-minister-diella/)
- [Wikipedia - Diella](https://en.wikipedia.org/wiki/Diella_(AI_system))
- [Tirana Times - AKSHI Arrests](https://www.tiranatimes.com/akshi-director-arrested-in-major-corruption-probe/)
- [Balkan Insight - Data Leaks](https://balkaninsight.com/2021/12/23/massive-data-leaks-in-albania-pose-public-security-question/)

### Technical
- [MITRE ATT&CK - HomeLand Justice (C0038)](https://attack.mitre.org/campaigns/C0038/)
- [CISA Advisory AA22-264A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a)
- [Google Cloud - ROADSWEEP](https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/)

---

*Research conducted via passive OSINT techniques - January 2026*