A federal district court in the Eastern District of Virginia on Thursday, October 29, sentenced Ahmad Umar Agha, a Syrian hacker known online as “Th3Pr0,” to 42 months in prison for his central role in a hacking conspiracy that the Justice Department says was organized and led by members of former Syrian President Bashar al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate.
Source: U.S. Department of Justice
The conspiracy ran from as early as August 24, 2011, to January 31, 2024, according to the Justice Department. To spread the former Syrian government’s propaganda, Agha hacked approximately 47 Western media entities, businesses, non-governmental organizations, and U.S. and allied government entities, the department said.
The fake tweet that erased $136 billion
The best-known attack came on April 23, 2013, when Agha’s hack of the Twitter account of a widely respected news agency let him post a false claim that President Barack Obama was injured after two explosions at the White House. The post caused a flash crash that temporarily wiped $136 billion off the value of the stocks making up the Dow Jones Industrial Average, the Justice Department said.
According to court filings cited by the department, Agha later bragged about the hack in an interview with Business Insider, saying it “was our goal of that hack attack” for the Dow to drop significantly, and calling it “a big victory for us.”
Marines page defaced, White House accounts targeted
In another attack, Agha obtained access to the company hosting the U.S. Marine Corps’ recruitment website and redirected visitors to a server displaying an image encouraging Marines to refuse their orders and fight alongside the Syrian Army. About 3,500 potential visitors saw that image instead of recruitment material while the attack was live, the department said.
On two occasions, Agha also tried to take control of the White House’s social media page by stealing the usernames and passwords for White House staff email accounts. In one instance he succeeded, and used that unauthorized access in an unsuccessful effort to trick other White House staff into giving him access to the White House’s social media accounts, according to the Justice Department.
What prosecutors say the campaign was for
The Justice Department said the conspiracy penalized the free press for reporting on the former Syrian government’s atrocities during the Arab Spring and the subsequent Syrian Civil War, used information-warfare tactics to cause fear and confusion among the government’s opponents, collected intelligence for the former Syrian government, and attempted to cause mutiny or refusal of duty by members of the U.S. military. The Hacker News, summarizing the case history, reported that the group’s members sent phishing emails to steal employees’ passwords and then used those passwords to deface websites, redirect web traffic and hijack social media accounts.
Source: The Hacker News
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg. “His attacks on our networks and institutions, including one that temporarily erased $136 billion from U.S. investors, constitute an assault on the free press and our national and economic security.”
“Today’s sentence sends a clear message that those who target American institutions, journalists, and government entities with malicious cyber activity will be held accountable, no matter how long they attempt to evade justice,” said Darren B. Cox, Assistant Director in Charge of the FBI’s Washington Field Office, adding that Agha “spent a decade as a fugitive.” First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia said the case showed the threat posed by cyber criminals serving regimes hostile to the United States.
The damage bills, in full
Court filings described victims spending significant sums remediating the intrusions or restructuring their security. One company that provides online publishers with content, website ads and links — identified only as Company G — suffered a loss of approximately $35,000 a day for approximately six months. One global NGO was forced to deploy a new suite of network monitoring products costing around $250,000, retrain more than 800 staff members and upgrade its security system, suffering $480,000 in total losses, the department said.
A case that took more than a decade
Agha and his co-conspirator Firas Dardar were first charged by complaint on June 12, 2014, and indicted on May 17, 2018, the Justice Department said. The Hacker News reported that the complaint stayed sealed until March 2016, when the FBI added both men to its Cyber’s Most Wanted list with a $100,000 reward, and that Agha was in U.S. custody by November 2025, citing Court Watch reporting. Dardar remains a fugitive, according to the Justice Department, and is presumed innocent unless proven guilty. Dardar was also charged in a separate September 29, 2015 conspiracy alongside Peter Romar, a Syrian national then living in Germany; Romar was extradited to the Eastern District of Virginia and pleaded guilty on September 28, 2016.
The FBI’s Washington Field Office investigated the case with the FBI’s Cyber Division. Assistant U.S. Attorney Laura D. Withers for the Eastern District of Virginia and Trial Attorney Jacques Singer-Emery of the National Security Division’s National Security Cyber Section prosecuted it. Arab News reported Agha is 32 years old.
What happens next
Agha now begins a 42-month federal prison term for a campaign that began in 2011, when the Assad government — which fell in December 2024 — was fighting to control the story of its own war. The hunt for Dardar continues, and the sentence closes the American court case against the hacker prosecutors call the central figure in one of the earliest state-backed social-media attacks ever to move U.S. markets. For newsrooms and companies, the case is a standing reminder of why account security matters: a single stolen password at one news agency briefly erased $136 billion in market value.