Syrian Hacker Sentenced After 12 Years

A federal court in the Eastern District of Virginia sentenced Ahmad Umar Agha to 42 months in prison on Thursday, the Justice Department said, more than 12 years after he was first charged in connection with a hacking conspiracy the government ties to the Syrian Electronic Army (SEA). The DOJ said Agha, who went by the online handle Th3Pr0, had evaded US authorities for over a decade. The department's announcement did not explain how or where he was taken into custody.

Charged in 2014, Unsealed in 2016

Agha and an alleged accomplice, Firas Dardar, were first charged by criminal complaint in June 2014. The case was unsealed in March 2016, at which point the FBI added both men to its Cyber's Most Wanted list and offered a reward of up to $100,000 for information leading to Agha's arrest.

A grand jury indicted the pair in May 2018. According to the account, Dardar has yet to be caught.

Agha's appearance in a federal courtroom in November 2025 was first reported by legal news outlet Court Watch. The DOJ's announcement of the sentencing does not address the circumstances of his apprehension.

A Conspiracy Tied to Assad's Circle

Prosecutors say the hacking conspiracy Agha took part in was directed by figures close to Bashar al-Assad, among them the head of Syria's General Intelligence Directorate. The DOJ described Agha as a central figure in the operation.

According to the department, the scheme began as early as August 2011 and continued until January 2024. Over that span, Agha is said to have compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries.

The range of victims described by prosecutors runs from major media organizations to a military recruiting site to individual White House staffers, each requiring its own approach.

The AP Account and a $136 Billion Wipeout

Among the intrusions prosecutors highlighted was the 2013 takeover of the Associated Press's Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House.

The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average's component stocks, according to the account.

The episode is the most financially visible item in the government's description of the conspiracy, illustrating how access to a single social media account can move markets well beyond the immediate victim.

Marine Corps Site and White House Attempts

Agha also gained access to the company hosting the Marine Corps' recruiting website and redirected its traffic to an image calling on Marines to defy their orders.

Separately, he twice went after the White House's social media presence by targeting the email credentials of White House employees. In one instance he obtained the credentials, but his attempt to use that access to dupe other staffers into handing over their accounts did not work.

Those two efforts, as described by the DOJ, involved credential theft rather than exploitation of a technical flaw in a platform itself.

Cleanup Bills for the Victims

The intrusions left many victims with large bills for cleanup and security overhauls, according to prosecutors.

• A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months.
• A global NGO spent roughly $250,000 on new network monitoring tools and retrained more than 800 employees, with total losses of $480,000.
• Agha compromised around 47 targets between August 2011 and January 2024.
• The FBI offered a reward of up to $100,000 for information leading to his arrest.
• The flash crash tied to the AP post briefly wiped $136 billion off the Dow Jones Industrial Average's component stocks.

The NGO's figure covers security upgrades alongside the monitoring tools and staff retraining, while the publishing services firm's cost is expressed as a daily rate sustained over roughly half a year.

Two Defendants, One Still at Large

The government's description of the case involves two named defendants. Agha was sentenced on Thursday; Dardar, his alleged accomplice, has not been caught, according to the account.

The DOJ's announcement, as reported, does not describe how or where Agha was taken into custody, leaving the circumstances of his transfer to US jurisdiction unaddressed in the public record.

The case was unsealed in March 2016 alongside the FBI's public appeal, and the grand jury indictment followed in May 2018.

Earlier Charges in the Same Orbit

The sentencing follows earlier charges against figures associated with the Syrian Electronic Army, a group whose activities have drawn US prosecution over a period of years.

The government's account places the conspiracy's direction with people close to Bashar al-Assad, including the head of Syria's General Intelligence Directorate.

Agha's conduct, as described, spanned media, military recruiting, and executive-branch social media targets, with the associated costs falling on the organizations whose systems and accounts were compromised.

What the Sentence Means for Defenders

The 42-month sentence resolves the prosecution of one defendant while the government's case against Dardar remains open, since he has not been apprehended. For organizations in the categories prosecutors listed — news outlets, companies, NGOs, and government bodies — the dollar figures attached to the victims' cleanup suggest where the practical cost of a compromised account or hosted site tends to land: on monitoring, retraining, and security overhauls rather than on the intrusion itself.

The White House episode, in which obtained credentials were used in an attempt to trick other staffers into surrendering their accounts, points to the human layer of credential handling as a recurring element in the described operation. The AP incident, in which a single hijacked account was used to publish a fabricated report that moved markets, illustrates how far the effects of such access can travel. Neither observation changes the outcome of the case; both are visible in the facts the government laid out.