A Syrian man tied to the Syrian Electronic Army (SEA) has received a 42-month prison sentence in the US, more than 12 years after he was first charged.
Ahmad Umar Agha, who used the online handle Th3Pr0, was sentenced on Thursday by a federal court in the Eastern District of Virginia. According to the Justice Department, he evaded US authorities for more than a decade.
Prosecutors say the hacking conspiracy Agha took part in was directed by figures close to Bashar al-Assad, among them the head of Syria’s General Intelligence Directorate. The scheme began as early as August 2011 and continued until January 2024.
The DOJ described Agha as a central figure in the operation. He compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries.
Among the intrusions highlighted by prosecutors was the 2013 takeover of the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks.
Agha also gained access to the company hosting the Marine Corps’ recruiting website and sent its traffic to an image calling on Marines to defy their orders.
He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.
The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.
Agha and his alleged accomplice, Firas Dardar, were first charged by criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.
A grand jury indicted the pair in May 2018. Dardar has yet to be caught.
Agha’s appearance in a federal courtroom in November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.
Related: Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
Related: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Related: Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
