A Syrian linked to the Syrian Electronic Army (SEA) was sentenced to 42 months in prison in the United States, more than 12 years after his first indictment.
Ahmad Umar Agha, who used the online handle Th3Pr0, was sentenced Thursday in federal court in the Eastern District of Virginia. According to the Justice Department, he eluded U.S. authorities for more than a decade.
Prosecutors say the hacking plot in which Agha participated was led by figures close to Bashar al-Assad, including the head of Syria’s General Directorate of Intelligence. The project began in August 2011 and continued until January 2024.
The DOJ described Agha as a central figure in the operation. It compromised approximately 47 targets, a mix of Western media, businesses, NGOs and government agencies in the United States and allied countries.
Among the intrusions highlighted by prosecutors was the 2013 takeover of the Associated Press Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama was injured in two explosions at the White House. The false message triggered a flash crash that briefly wiped $136 billion from the combined value of the Dow Jones Industrial Average’s component stocks.
Agha also gained access to the company hosting the Marine Corps recruiting website and sent his traffic to an image calling on Marines to defy their orders.
He twice attacked the White House’s social media presence by targeting the email handles of White House employees. In one case he obtained them, but his attempt to use this access to get other staff to hand over the accounts did not work.
The intrusions have left many victims with high bills for cleaning and security overhauls. A company providing online publishers with content, advertising and outbound links lost about $35,000 a day for about six months. A global NGO spent around $250,000 on new network monitoring tools, retrained more than 800 employees and improved its security, with total losses of $480,000.
Agha and his alleged accomplice, Firas Dardar, were first charged in a criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its most wanted list of cybercriminals and offered a reward of up to $100,000 for information leading to Agha’s arrest.
A grand jury indicted both men in May 2018. Dardar has not yet been arrested.
of Agha appearance in federal court in November 2025, was first reported by legal media outlet Court Watch. The DOJ announcement does not explain how or where he was taken into custody.
Related: Bulletproof Virtualine host loses domain following FBI seizure
Related: More than $2 million drained from Polymarket merchants in new supply chain attack
Related: Ukrainian affiliate of Hive and Nefilim Ransomware gets 70 months in prison in the United States
