海角大神

The pro-Syrian cyberhackers behind the recent attacks on major media outlets鈥� Twitter accounts claim to be members of a grass-roots organization defending the honor of the nation, but are likely nothing more than government-backed cyberwarriors, some researchers say.

The hacks by the Syrian Electronic Army (SEA) on Twitter reflect an intensifying effort in recent weeks to disseminate pro-Syrian propaganda and attack Syria鈥檚 perceived enemies in the media. The emphasis marks an apparent shift for the group, which previously had focused more on attacking and defacing websites and Facebook pages of members of Syria鈥檚 opposition and others they perceived as anti-Syrian, according to close observers of the group.

The most recent attack came Monday, with the SEA hacking into several Twitter accounts belonging to the British newspaper,听The Guardian.

Shortly after, Twitter warned news organization in an e-mail that their accounts could be vulnerable. Twitter has been shutting down the latest versions of the official SEA Twitter channel (the group was on its 12th) as fast as the San Francisco-based company can find them.

Citing 鈥渟everal recent incidents of high-profile news and media Twitter handles being compromised,鈥� the company wrote that: 鈥淲e believe that these attacks will continue, and that news and media organizations will continue to be high value targets to hackers.鈥�

Twitter hack victims have so far included CBS, NPR, and the BBC. Previously hacked organizations included Human Rights Watch, Reuters, Sky News Arabia, and even the FIFA World Cup organization. The AP and BBC both reported that 鈥減hishing鈥� e-mails were sent to their staff about the same time accounts got hacked.

But the biggest听鈥渢wit-hit鈥澨齱as on April 25, when the official Twitter account of the Associated Press was hijacked and used to tweet a hoax that the White House had been hit by bombs and President Obama injured. The US stock market immediately plummeted 145 points, the fake news erasing an estimated $200 billion in market value 鈥� at least for a few minutes 鈥� before it rebounded.

The group has now hit 鈥渂asically every media outlet on the planet from ABC News, to Reuters, to now the Associated Press," Jared Keller,听Bloomberg News social media director told the BBC.

What鈥檚 behind the Twitter hacks is a bald effort to win attention for听Syria鈥檚 cause and to attack the nation鈥檚 perceived enemies in the media, several close observers say.

Some researchers who have been tracking the SEA for years say the group appears to have at least 鈥渢acit support鈥� from听Syrian President Bashar al-Assad. Others argue the group is operated out of Dubai by deep-pocketed supporters of the Syrian regime. Still others say the connection with the Assad regime听is听quite direct.

鈥淭he SEA definitely has a close relationship with the regime,鈥� says Amjad Baiazy, an independent cyber-researcher in London who was held in detention by the regime in 2011. 鈥淚 can鈥檛 say if they are also supported by certain individuals, but I can say they are funded by the regime. There are also strong indications that members of the group are trained by Iranian [information technology] experts.鈥�

The fact that the group鈥檚 website is hosted on the national Syrian network, where local web hosting is highly politicized, indicates at the very least 鈥渢acit support鈥� from the Assad regime, according to Helmi Noman, a senior researcher with Citizen Lab, a cyber-research center at the University of Toronto.

Such 鈥渓ocal hosting听of sensitive content indicates state approval or at least tolerance of the content and the people behind the content,鈥� Mr. Noman writes in an e-mail interview. Even so, 鈥淚 do not have information that suggests that the SEA is a Syrian state operation, but the tacit support which we have documented can potentially amount to sponsorship.鈥�

It is significant, as well, that President Assad thanked the group in a major televised speech in 2011, which Noman calls 鈥渁 prerequisite political blessing without which such a group with questionable activities cannot operate.鈥�

In that speech to Damascus University, Assad likened online cyberwarriors to his best troops: "The army consists of the brothers of every Syrian citizen,鈥� he said. 鈥淵oung people have an important role to play at this stage, because they have proven themselves to be an active power. There is the electronic army, which has been a real army in virtual reality."

When the domain names of the SEA were seized last month by US authorities, the SEA survived the interruption by launching a new country code top-level domain name 鈥� sea.sy 鈥撎齠or its website, Noman writes. Doing so, 鈥渋mplies that the national agency in charge of domain name registration does not find the SEA's hacking and compromising activities objectionable,鈥� he notes.

Still, the SEA has steadfastly denied on its website any links to the Syrian regime, portraying itself as just a group of self-organized volunteers.

鈥淲e are a group of enthusiastic Syrian youths who could not stay passive towards the massive distortion of facts about the recent uprising in Syria, and this distortion is carried out by many Facebook pages that deliberately work to spread hatred and sectarian intolerance between the peoples of Syria to fuel the uprising,鈥� the group鈥檚 description says on its website.

Distancing itself is not surprising,听the听researchers say.

鈥淭he state needs this distance so that it cannot be held legally, politically, or even financially responsible for the SEA's activities,鈥� Noman writes. 鈥淥n the other hand, I won't be surprised if the Syrian institutions at some point defend their support [for] the SEA, arguing that their activities come in the context of a legitimate听cyberwar. In fact, that is how the local media is portraying them in its celebratory reports which I have been looking at.鈥�

The SEA has shifted from defacing political and mostly apolitical websites to targeting the media, which it perceives as hostile to the Syrian regime. The SEA, for instance, has not targeted "friendly" Russian or Iranian media, observers say. The group also likes media attention, and compromising听the online presence of media outlets听amplifies their exposure to the media, they agree.

鈥淏asically they want to become famous to tell their story to the international community,鈥澨齭ays Mr.听Baiazy. 鈥淭o do this, they have to catch attention. So they target, for example, the Twitter account for Reuters. Believe it or not, they actually are trying to leave a positive impression about Syria.鈥�

Baiazy, who was imprisoned in Syria in 2011 and interrogated about his online activities, says those questioning him were very young and barely computer literate. If so, it remain a question about the far more sophisticated actors also said to be part of the Syrian Electronic Army, which has been systematically and clandestinely luring opposition sympathizers with tainted video links in e-mail, fake Skype encryption tools, and tainted online documents.

Those hackers believed to be allied to Syria's government have deployed听a听fairly sophisticated array of powerful spyware with names like DarkComet, backdoor.bruet, and Blackshades. Available on the Internet, these malware are used to infiltrate the personal computers of opposition figures and rights activists and send back information on their friends and contacts as well as passwords, cybersecurity experts say.

Also of note, The Guardian reports that听defectors from inside the SEA claim many听in the organization听moved last year from Damascus to a secret base in Dubai funded by Assad's billionaire cousin,听Rami Makhlouf, who controls it.

Pro-Assad activists are said to receive $500 to $1,000 for attacks on major Western targets 鈥� a huge sum for most Syrians, The Guardian reported.