Syrian hacker who served Assad regime gets 42 months in US prison
Syrian hacker Ahmad Umar Agha sentenced to 42 months for Assad regime cyber operations targeting US entities and media.
Ahmad Umar Agha, a Syrian hacker working for Bashar Assad's regime, was sentenced to 42 months in federal prison for a decade-long hacking campaign targeting approximately 47 media, government, and NGO entities. His most notorious attack compromised the Associated Press Twitter account in 2013, posting false claims about Obama being injured and triggering a $136 billion stock market flash crash. Agha also targeted US Marine Corps recruitment websites, stole White House staff credentials, and attempted to incite US servicemembers to refuse orders.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Associated Press?
Get an email when a new story names Associated Press, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAhmad Umar Agha, operating on behalf of the Assad regime, spent a decade compromising media outlets, government agencies, and NGOs by stealing credentials and hijacking high-profile accounts like the Associated Press Twitter account. The 2013 AP hack demonstrated how a single compromised social media credential can cause catastrophic downstream effects — in this case, a $136 billion stock market flash crash from a single false tweet. Organizations failed to implement multi-factor authentication and proper credential hygiene, leaving accounts vulnerable to state-sponsored adversaries. This case underscores that credential compromise by nation-state actors is not hypothetical: robust identity controls and staff awareness are essential defenses for any organization with a public-facing presence.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Th3 Pr0