Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.
The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, the U.S. Justice Department said on October 29.
The pro-Assad Syrian Electronic Army began its attacks in 2011. Its members sent phishing emails to steal employees' passwords, then used those passwords to deface websites, redirect web traffic, and hijack social media accounts, according to a 2014 FBI affidavit.
On April 23, 2013, the group hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in two explosions at the White House.
Twitter's message confirming a password reset for that account was sent to a Gmail account used primarily by Agha, the affidavit says.
The Justice Department said Agha carried out that hack, which caused a temporary $136 billion drop in the value of stocks in the Dow Jones Industrial Average. Agha later told Business Insider that a big drop in the Dow "was our goal of that hack attack" and that "it was a big victory for us."
Agha was first charged in June 2014 in a complaint that remained secret until March 2016. That month, the FBI added him and co-defendant Firas Dardar to its Cyber's Most Wanted list with a $100,000 reward. A federal grand jury indicted both men in May 2018.
Court Watch reported in December 2025 that Agha was in U.S. custody and had appeared in federal court the month before.
Three earlier public documents in the case do not describe Syrian officials organizing or leading the group: the 2014 FBI affidavit, the Justice Department's March 2016 announcement of the charges, and its May 2018 announcement of the indictment.
In the 2016 announcement, the department said the group acted "in support of" the Syrian government.
An early study of the group, published by the OpenNet Initiative, found no credible evidence directly linking the attackers to the Syrian government beyond the unspoken support any such group would need to operate on Syrian networks.
In announcing the sentence, the department also said the conspiracy collected intelligence for Assad's government, which fell in December 2024. "Agha deployed his hacking skills in the service of Assad's regime to silence reporting on the regime's atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders," said John A. Eisenberg, Assistant Attorney General for National Security.
In all, Agha hacked about 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies, the department said.
He got into the company that hosted the U.S. Marine Corps recruiting website and redirected its visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. About 3,500 potential visitors saw that image instead of recruiting material.
He also twice tried to take over the White House's social media accounts by stealing White House staff email passwords. Once, he got into staff email but failed to trick other staff into giving him access.
The FBI affidavit describes the group breaking into a White House staff member's personal email account in July 2013 and says no official White House account was compromised.
Many victims spent large sums on cleanup and security upgrades, according to court filings cited by the department. One company that supplies online publishers with content, ads, and links lost about $35,000 a day for about six months. A global non-profit group lost $480,000, including about $250,000 on new network monitoring tools, and had to retrain more than 800 staff members.
Dardar remains a fugitive, the department said. He was also charged in a separate case with Peter Romar, a Syrian national then living in Germany. Romar was extradited to the U.S. and pleaded guilty in 2016.