Threat Intelligence
Syrian Electronic Army hacker sentenced to prison in US after decade-long pursuit
A Syrian hacker linked to the Syrian Electronic Army has been sentenced to 42 months in a US prison for attacks on media, businesses, and government bodies, over a decade after his first charges.
Ross GrantUpdated 2 min read
The short version
A Syrian hacker, Ahmad Umar Agha, was sentenced to 42 months in a US prison after more than ten years on the run. He was involved in cyber attacks against news outlets, businesses, and government agencies, including a high-profile Twitter hack that affected the stock market. The attacks caused financial losses and forced organisations to spend heavily on security. Authorities have not revealed how they captured him.
By the numbers
- 47organisations targeted over 13 yearsSecurityWeek
- $136 billionbrief market value lost after fake AP tweetSecurityWeek
- $35,000daily losses for one company over six monthsSecurityWeek
- $480,000total losses for a global NGOSecurityWeek
- 800+NGO employees retrained after attackSecurityWeek
- 42 monthsprison sentence for Ahmad Umar AghaSecurityWeek
What happened?
A US federal court sentenced Syrian hacker Ahmad Umar Agha to 42 months in prison for attacks on media, businesses, and government entities. Agha, linked to the Syrian Electronic Army, evaded US authorities for over a decade before his arrest. His attacks included hijacking the Associated Press’s Twitter account in 2013, which briefly caused a $136 billion drop in the stock market. The Justice Department has not said how or where he was apprehended.
Who is affected
According to SecurityWeek (opens in a new tab), Ahmad Umar Agha, known online as Th3Pr0, targeted around 47 organisations between 2011 and 2024. The victims included Western news outlets, private companies, non-governmental organisations (NGOs), and government agencies in the US and allied countries. Specific incidents involved the Associated Press, the company hosting the US Marine Corps’ recruiting website, and a global NGO that had to retrain over 800 employees after the attack.
How the attack worked
Prosecutors said Agha was a central figure in a hacking campaign directed by people close to Syrian President Bashar al-Assad, including Syria’s intelligence chief. His attacks included taking over social media accounts, stealing email credentials, and redirecting website traffic. In 2013, Agha compromised the Associated Press’s Twitter account and posted a fake report about explosions at the White House, which caused a temporary $136 billion drop in the Dow Jones Industrial Average. He also accessed the Marine Corps’ recruiting website, redirecting visitors to a propaganda image. On two occasions, he targeted White House staff email accounts, successfully obtaining credentials once, but failed to use them to take over further accounts.
What was taken
The attacks resulted in the theft of email credentials and unauthorised access to social media accounts. The financial impact was significant for several victims. One firm lost about $35,000 per day for six months due to the fallout. A global NGO spent $250,000 on new network monitoring tools and security upgrades, with total losses reaching $480,000.
The response
Agha was first charged in June 2014, and the case became public in 2016 when the FBI put him on its Cyber’s Most Wanted list, offering a $100,000 reward for information. A grand jury indicted him in 2018. He was finally brought to a US federal court in November 2025 and sentenced to 42 months in prison in October 2026. The Justice Department has not explained how or where Agha was apprehended. His alleged accomplice, Firas Dardar, remains at large.
Timeline
- August 2011: Start of hacking campaign
- 2013: Associated Press Twitter account hijacked
- June 2014: Agha first charged
- March 2016: FBI adds Agha to Cyber’s Most Wanted list
- May 2018: Grand jury indictment
- November 2025: Agha appears in US federal court
- October 2026: Sentenced to 42 months in prison
Why it matters
This case shows how cyber attacks can have real-world financial consequences and disrupt major organisations. It also highlights the persistence of law enforcement in pursuing cybercriminals, even years after the crimes.
Key points
- Syrian hacker Ahmad Umar Agha sentenced to 42 months in US prison
- His attacks included hijacking the Associated Press Twitter account in 2013
- The fake tweet briefly wiped $136 billion from the Dow Jones index
- Victims included media, businesses, NGOs, and government agencies
- Agha evaded authorities for over a decade before being caught
Sources
SecurityWeek
Reference
