Syrian Electronic Army member Agha gets 42 months in US
Ahmad Umar Agha, a Syrian Electronic Army operator behind the 2013 AP Twitter hoax that briefly erased $136 billion in market value, was sentenced to 42 months.
Ahmad Umar Agha, a member of the pro-Assad Syrian Electronic Army (SEA) who used the handle "Th3Pr0," was sentenced to 42 months in prison by a US federal court in the Eastern District of Virginia. The case runs through the same EDVA office whose 2016 indictment of two SEA members first charged him; the sentencing was reported by SecurityWeek, The Hacker News, and Recorded Future News. The Department of Justice has not yet published a standalone sentencing release at the time of writing.
What he did
Agha was part of the SEA's "special operations division." Prosecutors tie him to a conspiracy that ran from August 2011 to January 2024 and hit roughly 47 targets — Western news outlets, companies, NGOs, and government bodies in the US and allied countries.
The headline incident is the April 2013 takeover of the Associated Press Twitter account, which posted a fabricated report that explosions at the White House had injured President Obama. The fake tweet triggered a flash crash that briefly wiped about $136 billion off the combined value of the Dow Jones Industrial Average's component stocks before markets recovered.
Other activity cited at sentencing:
- Compromising a Marine Corps recruiting website and redirecting visitors to a message urging Marines to defy orders.
- Twice targeting White House staff email credentials — succeeding once, with a follow-up phishing attempt failing.
The damage
The court record puts hard numbers on the fallout:
- A content, advertising, and outbound-link firm lost about $35,000 per day for roughly six months.
- A global NGO reported total losses of $480,000, including about $250,000 on network-monitoring tools and retraining more than 800 employees.
Attribution
This one does not need hedging — it is a guilty finding in a US federal court, not a vendor assessment. Prosecutors say the conspiracy was directed by figures close to Bashar al-Assad, including the head of Syria's General Intelligence Directorate, and describe Agha as "a central figure in the operation." He was first charged by complaint in 2014, added to the FBI's Cyber's Most Wanted list in 2016 with a reward of up to $100,000, indicted in 2018, and appeared in court in November 2025 after more than a decade at large.
Co-defendant Firas Dardar ("The Shadow") has not been caught.
What to do today
Nothing operational — this is a prosecution, not a live vulnerability. But two durable lessons:
- A trusted account is a market-moving weapon. The AP incident remains the cleanest proof that one hijacked social account can move indices. Lock newsroom and brand accounts behind phishing-resistant MFA and tight recovery controls.
- Credential phishing of staff was the entry point, not an exotic exploit. The White House and media compromises here came from going after people's logins — the same vector that still dominates intrusions a decade later.
Context
The SEA was one of the 2010s' most visible hacktivist crews, and its members have aged into the slow machinery of international prosecution rather than fading out. The sentencing fits the same enforcement pattern as recent infrastructure takedowns: the US is steadily closing out long-running cybercrime and state-aligned cases years after the fact, betting that patience and extradition eventually catch operators who assumed distance made them safe. For Dardar, the bet is still open.