Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

What it is

Ahmad Umar Agha (handle Th3Pr0), a Syrian Electronic Army member, was sentenced to 42 months by a federal court in the Eastern District of Virginia. The page gives no sentencing date beyond "Thursday". The Justice Department says the conspiracy ran from as early as August 2011 until January 2024 and was directed by figures close to Bashar al-Assad, including the head of Syria's General Intelligence Directorate.

How it works

The page names three intrusion patterns, each with a different entry point:

• Social media takeover: the 2013 hijack of the Associated Press Twitter account, used to post a false report that President Obama was hurt in two White House blasts. The post triggered a flash crash that briefly removed $136 billion from the combined value of the Dow Jones Industrial Average's component stocks.
• Third-party hosting compromise: Agha accessed the company hosting the Marine Corps recruiting website and redirected its traffic to an image urging Marines to defy their orders.
• Staff credential targeting: twice, he went after White House social media accounts through the email credentials of White House employees. In one case he obtained the credentials, but his attempt to use them to trick other staff into handing over the accounts failed.

The page does not describe the technical method behind any of these.

Impact figures

• A firm supplying online publishers with content, advertising and outbound links lost about $35,000 per day for about six months.
• A global NGO spent about $250,000 on network monitoring tools, retrained more than 800 employees and upgraded its security. Its total losses were $480,000.

Case timeline

• June 2014: Agha and Firas Dardar charged by criminal complaint.
• March 2016: case unsealed, both placed on the FBI Cyber's Most Wanted list, and a reward of up to $100,000 offered for information leading to Agha's arrest.
• May 2018: grand jury indictment.
• November 2025: Agha appears in federal court, first reported by Court Watch.

Caveats

The DOJ announcement does not say how or where Agha was taken into custody. Dardar has not been caught. The page offers no indicators, detections or mitigations.