Syrian Electronic Army Hacker Jailed for 42 Months

A Syrian Electronic Army hacker who spent more than a decade as a fugitive has been sentenced to 42 months in a US prison for a hacking campaign run on behalf of Bashar al-Assad’s government. Ahmad Umar Agha, known online as Th3Pr0, was sentenced on 29 October in the Eastern District of Virginia, the Justice Department said.

Prosecutors say Agha hacked about 47 Western media organisations, businesses, non-profit groups and US and allied government bodies. One of his attacks, a fake post from a news agency’s hijacked Twitter account in 2013, briefly knocked $136 billion off the value of the stocks in the Dow Jones Industrial Average.

In brief

The Justice Department says the conspiracy was organised and led by members of Assad’s inner circle, including the head of Syria’s General Intelligence Directorate, from 2011 to January 2024.
Victims included a firm that lost about $35,000 a day for six months and a global non-profit that lost $480,000.
A co-defendant, Firas Dardar, is still a fugitive.

What the Syrian Electronic Army hacker did

The US Attorney’s Office for the Eastern District of Virginia says the campaign “penalized the free press for reporting on the former Syrian government’s atrocities”, used information warfare to spread fear among the government’s opponents, gathered intelligence for Damascus, and tried to push US service members to refuse orders.

According to court filings cited by prosecutors, the attacks included:

A fake White House explosion report. On 23 April 2013 Agha used a hijacked news agency’s Twitter account to post a false claim that President Obama had been injured in two explosions at the White House. The department says this caused the $136 billion flash crash. The Hacker News reports that the account was the Associated Press’s, citing a 2014 FBI affidavit. Agha later told Business Insider that the market drop “was our goal of that hack attack” and “it was a big victory for us”, prosecutors say.
A Marine Corps recruiting site. Agha got into the company hosting the site and sent visitors to an image urging Marines to refuse their orders and fight alongside the Syrian army. About 3,500 potential visitors saw it.
White House staff accounts. Twice he tried to take over the White House’s social media pages by stealing staff email passwords. In one case he used that access in an unsuccessful attempt to trick staff into handing over the accounts. In 2016 the department said no account of the Executive Office of the President was ever compromised.
Costly clean-ups. A company supplying websites with content, ads and links lost about $35,000 a day for about six months. A global non-profit spent about $250,000 on new network monitoring, retrained more than 800 staff and lost $480,000 in total.

A decade-old case reaches sentencing

Agha was first charged by complaint on 12 June 2014. When the charges were unsealed in March 2016, the Justice Department named him and Dardar as members of the Syrian Electronic Army, said both were believed to be in Syria, and the FBI added them to its Cyber’s Most Wanted list with a $100,000 reward. The two were indicted on 17 May 2018.

Neither of this week’s releases says when or how Agha came into US custody. A detention order filed in the case on 29 October 2025 shows a magistrate judge ordered him held pending trial, finding that no conditions of release would reasonably assure his appearance. The releases are also silent on whether he pleaded guilty or was convicted at trial.

“Today’s sentence should serve as a reminder of the National Security Division’s long memory in pursuit of state-sponsored hackers such as Agha,” Assistant Attorney General for National Security John A. Eisenberg said, in a statement also posted by the division on X. Darren B. Cox, assistant director in charge of the FBI’s Washington Field Office, said attackers “will be held accountable, no matter how long they attempt to evade justice”. The Eastern District of Virginia office shared the result on X on 30 October.

Dardar remains at large. He was also charged in a separate extortion case with Peter Romar, who was extradited from Germany and pleaded guilty in 2016.

Phishing, not exotic tools, powered the Syrian Electronic Army hacker

The case is a reminder that state-directed hacking does not need advanced tools to do damage. The complaint allegations DOJ summarised in 2016 describe a campaign built on spear-phishing: tricking employees into giving up passwords, then using them to deface websites, redirect domains and hijack social media accounts. The Marine Corps attack went through a third-party hosting company, not the Marines’ own systems. A single stolen login to a trusted news account was enough to move US markets, if only briefly.

For defenders, those are familiar failures with familiar fixes: phishing-resistant sign-in for staff and shared social accounts, tight control over what vendors can change on a website, and quick ways to verify and pull down a false post. The White House attempts show the value of layered checks, since stolen staff email access did not lead to control of official accounts.

The Justice Department’s framing has also hardened. In 2016 it said the group worked “in support of” the Syrian government. This week it says the conspiracy was “organized and led” by Assad’s inner circle, including the intelligence chief, a sharper claim of state direction that puts the case alongside other state-aligned operations such as the Belarus-aligned wiper attack ESET reported and North Korean groups using AI. Assad’s government fell in December 2024, so this sentence is about deterrence and accountability rather than disrupting a live operation.

The 42-month term is shorter than recent US cyber sentences such as the 70 months for a Hive and Nefilim ransomware affiliate and the eight years for a Nigerian who hacked tax preparers. The releases give no explanation of how the court arrived at it. What to watch next is whether Dardar is ever caught, and whether the Syrian Electronic Army hacker’s court file reveals more about how he was brought to the US.