Threats & Adversaries

AP account takeover carried Assad-linked campaign into markets

The Justice Department says Syrian Electronic Army-linked hacker Ahmad Umar Agha received a 42-month U.S. prison sentence for a state-directed campaign that compromised about 47 media, business, NGO, and government targets. Prosecutors say figures close to Bashar al-Assad, including Syria’s intelligence chief, directed the operation, which ran from August 2011 through January 2024.

In 2013, Agha used the Associated Press’s trusted Twitter account to post a fabricated report that President Barack Obama had been hurt in White House blasts. The Justice Department says the false post triggered a flash crash, briefly wiping $136 billion from the combined value of Dow Jones component stocks.

A publisher lost about $35,000 a day for six months, and a global NGO reported $480,000 in total losses after security upgrades and other remediation. Agha’s sentence closes his case, while alleged accomplice Firas Dardar remains at large. For organizations whose official accounts carry public trust, the case shows how stolen access can send a false claim into markets or public response, leaving the institution to bear the lasting cleanup costs.

5 sources · 4h ago

Timeline

Sources

Part of the PlainSec briefing for 2026-10-31

Every edition of this story: AP account takeover carried Assad-linked campaign into markets

More from today