Ahmad Umar Agha, known online as “Th3Pr0,” has been sentenced to 42 months in a U.S. federal prison for orchestrating a hacking scheme that significantly disrupted the stock market. Agha, a member of the Syrian Electronic Army, was implicated in a conspiracy aimed at western media outlets, as confirmed by the U.S. Justice Department on October 29.
Background of the Syrian Electronic Army
Beginning in 2011, the Syrian Electronic Army launched cyberattacks to support former President Bashar al-Assad’s regime. The group employed phishing emails to obtain credentials, which were then used to alter websites, redirect web traffic, and take control of social media accounts. A pivotal moment occurred on April 23, 2013, when the group seized the Associated Press’s Twitter account, falsely reporting injuries to President Barack Obama from explosions at the White House.
This false report led to a staggering $136 billion temporary decline in the Dow Jones Industrial Average. Agha later admitted the downturn was a primary objective of their efforts, describing it as a significant success.
Legal Proceedings and Sentencing
Charges against Agha emerged in June 2014, culminating in his addition to the FBI’s Cyber’s Most Wanted list alongside co-defendant Firas Dardar. This led to a grand jury indictment in May 2018. Agha was taken into U.S. custody by 2025, making his first court appearance shortly thereafter. The Justice Department highlighted that the conspiracy gathered intelligence for Assad’s government, which ultimately fell in December 2024.
John A. Eisenberg, Assistant Attorney General for National Security, noted that Agha’s hacking activities aimed to suppress unfavorable reporting on Assad’s administration, intimidate dissenters, and provoke U.S. military personnel against following orders.
Impact of the Cyber Attacks
Agha’s actions affected approximately 47 western media, business, and non-profit organizations, as well as U.S. and allied government agencies. Notably, he compromised the hosting company for the U.S. Marine Corps recruiting website, redirecting users to propaganda. He also attempted to breach White House social media accounts by infiltrating staff emails, though these efforts were ultimately unsuccessful.
Victimized organizations incurred substantial financial losses and were forced to invest heavily in security enhancements. For instance, one company faced daily losses of $35,000 over six months, while a global non-profit accrued $480,000 in costs, including $250,000 for new monitoring tools.
Despite Agha’s sentencing, Firas Dardar remains at large. He faces additional charges from a separate case involving Peter Romar, another Syrian national extradited and convicted in the U.S. in 2016.
