[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBWjjN9904UUp8g0nDTe1M3LxdN_c5fZov6ug7VmMBHE":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a68aef6d-0fe7-4b1f-9da5-b49caa7600ef","Syrian hacker who served Assad regime gets 42 months in US prison","syrian-hacker-who-served-assad-regime-gets-42-months-in-us-prison-48586a","Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing. The post Syrian hacker who served Assad regime gets 42 months in US prison appeared first on CyberScoop.","Ahmad Umar Agha, a Syrian hacker working for Bashar Assad's regime, was sentenced to 42 months in federal prison for a decade-long hacking campaign targeting approximately 47 media, government, and NGO entities. His most notorious attack compromised the Associated Press Twitter account in 2013, posting false claims about Obama being injured and triggering a $136 billion stock market flash crash. Agha also targeted US Marine Corps recruitment websites, stole White House staff credentials, and attempted to incite US servicemembers to refuse orders.","Syrian hacker Ahmad Umar Agha sentenced to 42 months for Assad regime cyber operations targeting US entities and media.","https:\u002F\u002Fcyberscoop.com\u002Fsyrian-hacker-ahmad-umar-agha-sentenced\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F03\u002FGettyImages-1237552037.jpg","2026-10-30T14:33:22+00:00","2026-10-30T15:00:19.159291+00:00",8,[17,20,22,24,27,30],{"name":18,"type":19},"Ahmad Umar Agha","threat_actor",{"name":21,"type":19},"Firas Dardar",{"name":23,"type":19},"Peter Romar",{"name":25,"type":26},"Assad regime cyber operations","campaign",{"name":28,"type":29},"Associated Press","vendor",{"name":31,"type":29},"US Marine Corps","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"malware","Th3 Pr0","Hacker handle used by Ahmad Umar Agha for cyber operations",[28,31],{"controls":60,"vendors":142},[61,90,116],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,108],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":104,"product_name":105,"url":106,"description":107},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":117,"name":118,"problem":119,"products":120},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":138,"product_name":139,"url":140,"description":141},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"syrian-state-hackers-decade-long-campaign-highlights-credential-theft-and-social-engineering-risks","Syrian State Hacker's Decade-Long Campaign Highlights Credential Theft and Social Engineering Risks","Ahmad Umar Agha, operating on behalf of the Assad regime, spent a decade compromising media outlets, government agencies, and NGOs by stealing credentials and hijacking high-profile accounts like the Associated Press Twitter account. The 2013 AP hack demonstrated how a single compromised social media credential can cause catastrophic downstream effects — in this case, a $136 billion stock market flash crash from a single false tweet. Organizations failed to implement multi-factor authentication and proper credential hygiene, leaving accounts vulnerable to state-sponsored adversaries. This case underscores that credential compromise by nation-state actors is not hypothetical: robust identity controls and staff awareness are essential defenses for any organization with a public-facing presence.",[148,149,150,151,152,153,154],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","MITRE ATT&CK T1566: Phishing","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":156,"MITRE ATT&CK T1566: Phishing":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 17: Incident Response Management":159,"CIS Control 14: Security Awareness and Skills Training":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"NIS2 requires entities to implement measures for incident handling and access control; the compromised government and media entities in this case lacked the mandated controls to prevent or rapidly contain state-sponsored credential attacks.","Agha's decade-long campaign used phishing and credential harvesting as primary initial access techniques, making this technique directly applicable and a key control gap to address.","Sustained access over a decade suggests unpatched vulnerabilities and unresolved security flaws were exploited repeatedly; systematic flaw remediation would have disrupted persistent access.","The AP Twitter compromise caused a flash crash before it was corrected, indicating a slow or absent incident response process; a rehearsed IR plan with rapid account lockdown procedures would have contained the damage faster.","Many of Agha's intrusions began with social engineering and credential theft targeting staff; regular, targeted security awareness training would have reduced the likelihood of employees falling victim to these tactics.","The prolonged campaign across 47 organizations points to unmanaged technical vulnerabilities in internet-facing systems, which this control requires organizations to identify and remediate in a timely manner.","Agha's campaign relied on stealing and abusing credentials; enforcing strong authentication and access controls as required by PR.AA would have significantly limited his ability to hijack accounts like AP's Twitter."]