Syrian Electronic Army Hacker Sentenced for AP Account Hijack
Ahmad Umar Agha, a Syrian Electronic Army hacker known online as “Th3Pr0,” has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy against Western news outlets. The U.S. Justice Department said Agha carried out the April 23, 2013 compromise of the Associated Press Twitter account, from which a false post claimed that President Barack Obama had been injured in explosions at the White House.
The false message caused a temporary $136 billion drop in the value of stocks in the Dow Jones Industrial Average, the Justice Department said. Agha’s sentence was announced on October 29, following a case that was initially charged in June 2014 and unsealed in March 2016.
Phishing-led account compromise
The pro-Assad Syrian Electronic Army began attacks in 2011. A 2014 FBI affidavit described its members sending phishing emails to obtain employee passwords, then using those credentials to deface websites, redirect traffic and take over social-media accounts.
For the Associated Press intrusion, Twitter’s password-reset confirmation was sent to a Gmail account used primarily by Agha, the affidavit said. The Justice Department stated that Agha conducted the hack. He later told Business Insider that a major Dow decline had been the group’s objective and called the result a victory.
In its sentencing announcement, the department said the conspiracy was organized and led by figures in former Syrian President Bashar al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate. It also said the operation gathered intelligence for Assad’s government, which fell in December 2024. Earlier public case documents had described the group as acting in support of the Syrian government, while an OpenNet Initiative study found no credible direct evidence linking attackers to the government beyond the support needed to operate on Syrian networks.
Targets ranged from media to government systems
The Justice Department said Agha hacked about 47 Western media organizations, businesses, non-profits, and U.S. and allied government bodies. He also accessed the company hosting the U.S. Marine Corps recruiting website and redirected visitors to an image urging Marines to refuse orders and fight alongside the Syrian Army. About 3,500 potential visitors saw the image instead of recruiting content.
Agha twice attempted to gain control of White House social-media accounts by stealing staff email passwords. In one instance, he accessed staff email but did not obtain the additional access needed for the social accounts. The FBI affidavit described a July 2013 compromise of a staff member’s personal email account and stated that no official White House account was compromised.
Costs extended beyond the initial breach
Court filings cited by the Justice Department describe substantial remediation costs for victims. One company supplying content, advertising and links to online publishers lost about $35,000 per day for roughly six months. A global non-profit lost $480,000, including approximately $250,000 for network monitoring tools, and retrained more than 800 employees.
Agha and co-defendant Firas Dardar were added to the FBI Cyber’s Most Wanted list in 2016 with a $100,000 reward, and both were indicted in 2018. Dardar remains a fugitive. For businesses, the case underlines that phishing-resistant authentication, restricted administrative access and rehearsed response plans for public-facing accounts are essential controls against disruptions whose effects can reach far beyond a single compromised password.