Cyber News / Article / Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
Syrian Hacker Gets Prison Time in US After Over a Decade on the Run
Hi, what are you looking for?
A US court sentenced Syrian hacker Ahmad Umar Agha to 42 months for pro-Assad attacks on media, businesses, and government entities.
By
A Syrian man tied to the Syrian Electronic Army (SEA) has received a 42-month prison sentence in the US, more than 12 years after he was first charged.Ahmad Umar Agha, who used the online handle Th3Pr0, was sentenced on Thursday by a federal court in the Eastern District of Virginia. According to the Justice Department, he evaded US authorities for more than a decade.Prosecutors say the hacking conspiracy Agha took part in was directed by figures close to Bashar al-Assad, among them the head of Syria’s General Intelligence Directorate. The scheme began as early as August 2011 and continued until January 2024.The DOJ described Agha as a central figure in the operation. He compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries.Among the intrusions highlighted by prosecutors was the2013 takeoverof the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks.Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders.Advertisement. Scroll to continue reading.He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Ahmad Umar Agha, who used the online handle Th3Pr0, was sentenced on Thursday by a federal court in the Eastern District of Virginia. According to the Justice Department, he evaded US authorities for more than a decade.Prosecutors say the hacking conspiracy Agha took part in was directed by figures close to Bashar al-Assad, among them the head of Syria’s General Intelligence Directorate. The scheme began as early as August 2011 and continued until January 2024.The DOJ described Agha as a central figure in the operation. He compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries.Among the intrusions highlighted by prosecutors was the2013 takeoverof the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks.Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders.Advertisement. Scroll to continue reading.He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Prosecutors say the hacking conspiracy Agha took part in was directed by figures close to Bashar al-Assad, among them the head of Syria’s General Intelligence Directorate. The scheme began as early as August 2011 and continued until January 2024.The DOJ described Agha as a central figure in the operation. He compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries.Among the intrusions highlighted by prosecutors was the2013 takeoverof the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks.Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders.Advertisement. Scroll to continue reading.He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
The DOJ described Agha as a central figure in the operation. He compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries.Among the intrusions highlighted by prosecutors was the2013 takeoverof the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks.Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders.Advertisement. Scroll to continue reading.He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Among the intrusions highlighted by prosecutors was the2013 takeoverof the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks.Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders.Advertisement. Scroll to continue reading.He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders.Advertisement. Scroll to continue reading.He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work.The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000.Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest.A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
A grand jury indicted the pair in May 2018. Dardar has yet to be caught.Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody.Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Related:Bulletproof Host Virtualine Loses Its Domain to FBI SeizureRelated:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Related:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Got a confidential news tip? We want to hear from you.
Reach a large audience of enterprise cybersecurity professionals
Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.
Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.
Related articles
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
6 days ago
Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving
6 days ago
Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison
6 days ago
You might Also like
POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability
Hackers Exploit Patched Synology NAS Vulnerabilities to Deploy C3RB3R Ransomware and Encrypt Files
