Tracking the hack even further, computer forensics from security firm Renesys Corp. traced the Internet protocol addresses back to the same ones as the Syrian Electronic Army's website sea.sy, which the firm said has been hosted out of Russia since June.
A Syrian Electronic Army activist confirmed to The Associated Press that the group hijacked the Times' and Twitter's domains by targeting Melbourne IT.
"I can't say how, but yes we did hit Melbourne IT," the hacker said in an email. No further details were disclosed.
The hacker's true identity isn't publicly known, but he has long used an email address linked to the group, and a second group member has vouched for his credentials.
The Syrian Electronic Army has, in recent months, taken credit for Web attacks on media targets that it sees as sympathetic to Syria's rebels, including prior attacks at the New York Times, along with the Washington Post, Agence France-Press, 60 Minutes, CBS News, National Public Radio, The Associated Press, Al-Jazeera English and the BBC.
FBI spokeswoman Jenny Shearer in Washington said the agency has no comment on Tuesday's attack.
Tuesday's victims were hit by a technique known as "DNS hijacking," according to Robert Masse, president of Montreal, Canada-based security startup Swift Identity.
The technique works by tampering with domain name servers that translate easy-to-remember names like "nytimes.com" into the numerical Internet Protocol addresses (such as "188.8.131.52") that computers use to route data across the Internet.
Domain name servers work as the Web's phone books, and if attackers gains access to one, they can funnel users trying to access sites like The New York Times or Twitter to whichever rogue server they please. Masse said DNS attacks are popular because they bypass a website's security to attack the very architecture of the Internet itself.