Hackers took control of a senior U.S. Space Force official’s Instagram account for an undisclosed number of hours on Sunday, posting images and stories with pro-Iranian and anti-U.S. propaganda.
Chief Master Sergeant of the Space Force John Bentivegna’s Instagram was compromised as the hackers posted multiple artworks and stories depicting anti-American messaging.
Before they were taken down, the images and stories posted to Bentivegna’s account circulated unofficial U.S. military social media accounts, including the Reddit page r/AirForce and the Facebook page Air Force amn/nco/snco.
One post depicted a figure known as Imam Ali holding the Sword of Zulfiqar, which was given to Ali by the Prophet Muhammad and is a symbol of justice and knowledge in Islamic tradition. The hackers also posted a depiction of Husayn ibn Ali, a political and religious figure in Islam.
A story posted by the hackers included audio of Trịnh Thị Ngọ, also known as “Hanoi Hannah,” a Vietnamese radio personality known for releasing English-language broadcasts during the Vietnam War. Ngọ delivered three broadcasts a day during the war, written by the North Vietnamese Defense Ministry’s propaganda department and aimed at American troops to demoralize and frighten them.
The audio was posted with a caption in Arabic that roughly translates to “This is your fate if you get close to the Middle East.”
Another story, which appeared to be directly after the “Hanoi Hannah” audio, was an edit of Ali Larijani, a prominent Iranian national security official, with a caption in Arabic that roughly translates to “I set foot in America.” Larijani died in mid-March 2026 in an Israeli military airstrike during the Iran war.
As well as the other two stories, the hackers posted a photo of Game of Thrones character Jon Snow during an episode titled Battle of the Bastards, with a graphic that included Arabic text reading “Abu Al-Ahmar Army,” or “Army of the Red One,” and text underneath that roughly translates to “ban the accounts of the haters.”
Bentivegna did not address the hack on Instagram but did post on his Facebook on Sunday around 8:30 p.m. EST, saying that “appropriate teams” were working to regain access to the account and resolve the issue.
“If you receive any direct messages, requests, links or unusual posts from that account, please do not engage with them,” Bentivegna wrote in the Facebook post.
“Experiences like this are a good reminder that cybersecurity isn’t just an issue for organizations, it’s something we all deal with in our daily lives,” Bentivegna added.
By 1 a.m. EST on Monday, the stories and posts were removed, according to Task & Purpose, which first reported on the hack.
A Space Force spokesperson confirmed to Military Times on Tuesday that Bentivegna’s account was compromised but denied to comment about how long the hackers had access to the account or who was responsible. All unauthorized content was removed with assistance from Meta, the owner of Instagram, the spokesperson said.
“This incident serves as a good reminder that online threats are constantly evolving, and users must remain alert to suspicious activity while exercising strong cybersecurity practices,” the spokesperson concluded.
The hackers also targeted former President Barack Obama’s White House Instagram account, posting the same image of Imam Ali holding the Zulfiqar sword, as well as stories, with one being a photo of Qasem Soleimani, an Iranian military officer killed in January 2020 in a U.S. drone strike, with a caption in Arabic that roughly translates to “The White House is under Shiites’ control.”
The hacks follow the recent reports received by military officials of service members’ commercial location data being used by adversaries to target personnel deployed to war zones. U.S. lawmakers said in a letter to the Pentagon that the location data can be used to identify where troops are congregated and their patterns, which then can be used to target the troops for various attacks.
Both abroad and domestically, U.S. service members have also been receiving threats through email, social media and text messages that appear to have originated from individuals connected to the Islamic Revolutionary Guard Corps.
Cristina Stassis is a reporter covering stories surrounding the defense industry, national security, military/veteran affairs and more. She previously worked as an editorial fellow for Defense News in 2024 where she assisted the newsroom in breaking news across Sightline Media Group.