Syrian Hacker Sentenced to 42 Months in US Prison for Pro-Assad Cyberattacks
Ahmad Umar Agha, a key figure in Syrian Electronic Army-linked cyber operations, has been sentenced to 42 months in prison in the US after evading authorities for over a decade.
A Syrian national identified as Ahmad Umar Agha has been sentenced to 42 months in federal prison in the United States, concluding a pursuit that spanned over a decade. Agha, who operated online under the handle Th3Pr0, was convicted for his role in a hacking conspiracy allegedly directed by individuals close to Syrian President Bashar al-Assad, including figures within the General Intelligence Directorate. The operation, which prosecutors state began as early as August 2011 and continued until January 2024, targeted a wide array of entities.
Prosecutors have identified Agha as a central participant in the scheme, responsible for compromising approximately 47 targets. These included Western news organizations, various businesses, non-governmental organizations, and government bodies located in the United States and allied nations. His activities aimed to disrupt operations, spread disinformation, and cause financial damage.
Among the most notable attacks attributed to Agha was the 2013 hijacking of the Associated Press's Twitter account. Using this compromised platform, he disseminated a false report claiming that then-President Barack Obama had been injured in explosions at the White House. This fabricated news triggered a significant market reaction, causing the Dow Jones Industrial Average to briefly shed $136 billion in value.
Further demonstrating the scope of his operations, Agha also gained unauthorized access to the company hosting the Marine Corps' recruiting website. He then redirected the site's traffic to display an image that encouraged Marines to disobey orders. Additionally, he made multiple attempts to compromise the White House's social media presence by targeting the email credentials of White House employees, though not all attempts were successful in gaining further access.
The intrusions carried substantial financial consequences for the victims. One content and advertising provider for online publishers reported losses of around $35,000 per day for approximately six months due to the disruptions. A global non-governmental organization incurred costs of roughly $480,000, which included investments in new network monitoring tools, extensive employee security retraining, and overall security upgrades.
Agha and an alleged accomplice, Firas Dardar, were initially charged via criminal complaint in June 2014. The case gained wider attention in March 2016 when the FBI added both individuals to its Cyber's Most Wanted list, offering a substantial reward for information leading to Agha's capture. A grand jury later indicted the pair in May 2018, though Dardar remains at large.
While Agha's sentencing occurred in November 2025, the specific details of his apprehension and return to US jurisdiction were not disclosed in the Justice Department's announcement. His conviction and sentencing underscore the long-term efforts by law enforcement to bring cybercriminals, particularly those linked to state-sponsored activities, to justice.