"Agha deployed his hacking skills in the service of Assad's regime to silence reporting on the regime's atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders," said John A. Eisenberg, Assistant Attorney General for National Security.
Agha's sentence and the Justice Department's account
On October 29, the U.S. Justice Department said a federal court sentenced Ahmad Umar Agha—known online as "Th3Pr0" and identified in filings as a Syrian Electronic Army hacker—to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets and other entities. The department said the conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate. The department also said the conspiracy collected intelligence for Assad's government, which fell in December 2024.
Tactics of the Syrian Electronic Army, as described by the FBI
The group began its attacks in 2011 and, according to a 2014 FBI affidavit, relied heavily on phishing emails to steal employees' passwords. Those credentials were then used to deface websites, redirect web traffic, and hijack social media accounts. The Justice Department said Agha hacked about 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies as part of the conspiracy.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildApril 23, 2013 — the AP Twitter incident and a $136 billion market shock
On April 23, 2013, the group hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in two explosions at the White House. The FBI affidavit states that Twitter's message confirming a password reset for the AP account was sent to a Gmail account used primarily by Agha. The Justice Department said the hack caused a temporary $136 billion drop in the value of stocks in the Dow Jones Industrial Average.
Agha later told Business Insider that a big drop in the Dow "was our goal of that hack attack" and that "it was a big victory for us." The department also described other disruptive attempts, including two tries to take over White House social media accounts by stealing White House staff email passwords; on one occasion an intruder accessed a staff member's personal email but the affidavit says no official White House account was compromised.
Costs to victims and other specific intrusions
The Justice Department cited substantial financial and operational impacts on victims. One company supplying online publishers with content, ads, and links lost about $35,000 a day for about six months. A global non-profit group lost $480,000, including about $250,000 spent on new network monitoring tools, and retrained more than 800 staff members. The department said many victims spent large sums on cleanup and security upgrades.
Beyond media defacements, Agha reportedly got into the company that hosted the U.S. Marine Corps recruiting website and redirected approximately 3,500 potential visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. The department said the conspiracy also sought and collected intelligence for Assad's government and attempted to intimidate opponents and influence U.S. servicemembers.
What this means for media organizations, the U.S. Marine Corps, and national security officials
- Media organizations: The case re-emphasizes the vulnerability of publisher and newsroom credentials to phishing-based intrusions and the downstream costs—both financial and reputational—when social accounts and distribution networks are hijacked.
- U.S. Marine Corps recruiting and military messaging: The redirected recruiting-site visitors (about 3,500 potential visitors) illustrate how attackers can leverage third-party hosting relationships to alter recruitment outreach and reach an intended audience directly.
- National security officials and prosecutors: The Justice Department's statement that the conspiracy was organized and led by Assad's inner circle and that it collected intelligence for the regime marks an assertive attribution in court filings; it sits alongside earlier public documents that did not describe Syrian officials as organizers or leaders. The department continues to contend there are operational and legal consequences: co-defendant Firas Dardar remains a fugitive, and earlier related cases produced convictions—Peter Romar was extradited and pleaded guilty in 2016.
The sentence closes a long-running legal thread that began with secret charges in 2014, a public addition to the FBI's Cyber's Most Wanted list in March 2016 (with a $100,000 reward), and an indictment returned by a federal grand jury in May 2018. Court Watch reported in December 2025 that Agha was in U.S. custody and had appeared in federal court in November 2025. The case ties operational phishing tradecraft to high-profile economic and reputational harms while leaving open the enforcement challenges posed by co-defendants still at large.
