Threat Intelligence
Syrian Electronic Army hacker jailed for attacks on Western organisations
Ahmad Umar Agha, a member of the Syrian Electronic Army, has been sentenced to 42 months in prison for hacking nearly 50 Western targets, including media outlets and non-profits, according to US authorities.
Ross Grant2 min read
The short version
A member of the Syrian Electronic Army, Ahmad Umar Agha, has been sentenced to over three years in prison for hacking Western organisations. His attacks included taking over the Associated Press's Twitter account and targeting the US Marine Corps' website. The group used these hacks to spread false messages and support the Syrian government. Only one news outlet has reported these details so far.
By the numbers
- 42 monthsprison sentence for Ahmad Umar AghaRecorded Future News
- 47Western organisations targeted in the attacksRecorded Future News
- $136 billionbrief stock market dip caused by AP Twitter hijackRecorded Future News
- $100,000FBI reward for Agha and another hackerRecorded Future News
What happened?
Ahmad Umar Agha, a member of the Syrian Electronic Army, was sentenced to 42 months in US federal prison for hacking nearly 50 Western organisations. The attacks included hijacking the Associated Press's Twitter account and redirecting the Marine Corps' recruiting website. The US Justice Department said the campaigns supported the Assad regime. Only Recorded Future News has reported these details so far.
Who is affected
According to the US Department of Justice, Ahmad Umar Agha (known online as “Th3Pr0”) targeted about 47 Western organisations. These included media outlets, non-profit groups and other entities allied with the United States. The attacks date back to at least 2011 and were carried out in support of the Syrian government under Bashar al-Assad. One high-profile victim was the Associated Press, whose Twitter account was hijacked in 2013. Another attack targeted the Marine Corps’ recruiting website, redirecting visitors to a propaganda message.
How the attack worked
The Syrian Electronic Army used a mix of hacking techniques. In the case of the Associated Press, the group hijacked the organisation’s Twitter account and sent a false tweet about an explosion at the White House. This social engineering attack caused panic and led to a brief $136 billion drop in the stock market. According to a 2014 FBI affidavit, the password reset for the AP’s Twitter account was sent to an email address linked to Agha. In another incident, Agha gained access to a company hosting the Marine Corps’ recruiting website and redirected users to a message urging US service members to disobey orders and join the Syrian Army. The group’s campaigns also collected intelligence for the Assad regime.
The response
Agha was first charged in 2014, and in 2016, the FBI added him and another Syrian Electronic Army member, Firas Dardar, to its Cyber’s Most Wanted list with a $100,000 reward. Both were indicted by a federal grand jury in 2018. Agha was taken into US custody in 2025, though the Department of Justice has not disclosed details of his arrest. On Thursday, a federal court in Virginia sentenced him to 42 months in prison for his role in the conspiracy. Dardar remains at large. The Justice Department said Agha’s actions were aimed at silencing reporting on the Assad regime, intimidating opponents and inciting US military personnel to refuse orders.
Has this happened before?
The Syrian Electronic Army has been active since at least 2011, carrying out a range of cyberattacks in support of the Assad government. Their campaigns have included targeting Western media, spreading disinformation and attempting to influence public opinion and military personnel.
Recorded Future News (opens in a new tab) is the only outlet to have reported these details so far. The Department of Justice has not released further information on Agha’s arrest or the full list of affected organisations.
Why it matters
This case shows how cyberattacks can be used for political influence and disinformation, with real-world consequences like stock market disruption. It also highlights the long reach of law enforcement, even years after the attacks.
Key points
- A Syrian Electronic Army hacker was sentenced to 42 months in US prison.
- Targets included about 47 Western media outlets and non-profits.
- The group hijacked the Associated Press's Twitter account, causing a $136 billion market dip.
- The attacks aimed to support the Assad regime and spread propaganda.
- Only one news outlet has reported these details so far.
Sources
Recorded Future News
Reference
