Syrian Hacker Sentenced for Market-Crashing White House Hoax
A Syrian national has been sentenced to 42 months in prison for his role in a hacking conspiracy that spread false information about an attack on the White House, causing a significant market drop.
Ahmad Umar Agha, also known as “Th3Pr0,” has been sentenced to 42 months in federal prison for his involvement in a hacking conspiracy orchestrated by members of former Syrian President Bashar Al-Assad’s inner circle. The scheme, which ran from August 2011 to January 2024, saw Agha use his hacking skills to spread propaganda and silence reporting on the Syrian regime's actions.
Prosecutors detailed how Agha compromised approximately 47 Western media outlets, businesses, NGOs, and U.S. and allied government entities. The conspiracy aimed to punish the press for reporting on the regime's atrocities during the Arab Spring and the subsequent Syrian Civil War. Assistant Attorney General for National Security John A. Eisenberg stated that Agha "deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders."
The most significant incident occurred on April 23, 2013, when Agha gained access to the Twitter account of a respected news agency. He posted a false report claiming that President Obama had been injured in two explosions at the White House. This fabricated news led to a temporary $136 billion drop in the value of stocks within the Dow Jones Industrial Average. Agha later boasted about the attack, calling the market drop "a big victory for us."
Beyond the market manipulation, Agha also targeted U.S. military recruitment efforts. He hacked the company hosting the U.S. Marine Corps’ recruitment website and redirected visitors to a server displaying a message urging Marines to refuse orders and join the Syrian Army. Approximately 3,500 potential recruits saw this message instead of recruitment materials.
Further attempts were made to compromise the White House's social media presence. Agha stole usernames and passwords for White House staff email accounts, successfully gaining access to one account. He then used this access in an unsuccessful attempt to trick other staffers into relinquishing control of the White House's social media accounts.
The cyber intrusions resulted in substantial costs for victims. Court filings indicate that several organizations incurred significant expenses for cleanup and security restructuring. One content supplier lost an estimated $35,000 per day for six months. A global NGO faced losses totaling $480,000, including the cost of new network monitoring products, extensive staff retraining, and security system upgrades.
Agha and his co-conspirator Firas Dardar were initially charged in June 2014, with Dardar remaining a fugitive. Dardar was later charged in a separate conspiracy in 2015 alongside Peter Romar, who was extradited from Germany and pleaded guilty in 2016. Agha himself remained on the run for over a decade before his sentencing.
The U.S. Justice Department revealed that the conspiracy was orchestrated by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate. This new detail clarifies the state-level backing for the Syrian Electronic Army's operations, which aimed to silence reporting on atrocities and intimidate opponents.