Ahmad Umar Agha, the Syrian Electronic Army-linked hacker known online as “Th3Pr0,” received a 42-month federal prison sentence in Virginia for his role in an Assad-linked hacking conspiracy, according to the U.S. Justice Department. The Ahmad Umar Agha sentence, announced October 29, followed a case that U.S. authorities said targeted Western media outlets, businesses, nonprofit groups and government entities.
The federal court in the Eastern District of Virginia imposed the sentence. The Justice Department said Agha held a central role in a conspiracy run by members of former Syrian President Bashar al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate.
The sentencing is a court outcome. The broader account of the hacking operation, its motives and its effects comes from the Justice Department and court filings.
What was Ahmad Umar Agha sentenced for?
According to the Justice Department, the conspiracy operated from at least August 24, 2011, through January 31, 2024. It said Agha hacked about 47 Western media organizations, companies, nongovernmental organizations, and U.S. and allied government targets as part of a propaganda and intelligence effort for Assad’s former government.
DOJ said the operation sought to punish outlets reporting on the Syrian government’s conduct during the Arab Spring and civil war, intimidate opponents and encourage U.S. service members to refuse orders. Those are the government’s characterizations of the campaign, not separate findings described in the sentencing announcement.
One of the best-known incidents involved the Associated Press’s Twitter account. DOJ said Agha used the compromised account on April 23, 2013, to post a false claim that President Barack Obama had been injured in explosions at the White House. The department said the post briefly erased $136 billion from the value of stocks in the Dow Jones Industrial Average.
The Record reported that a 2014 FBI affidavit linked an email address used by Agha to a Twitter message confirming a password reset for the account.
The Justice Department also said Agha obtained access to the company hosting the U.S. Marine Corps recruitment website and redirected visitors elsewhere. The Record reported that the destination carried propaganda urging service members to disobey orders and join the Syrian Army.
A long-running case ended with the Virginia sentence
Agha was first charged in 2014, according to The Record. The FBI added him and alleged Syrian Electronic Army member Firas Dardar to its Cyber’s Most Wanted list in 2016, offering a $100,000 reward. A federal grand jury indicted both men in 2018.
The Record said Agha was taken into U.S. custody in the year before sentencing, though the Justice Department did not disclose details of how or where that happened. Dardar remains a fugitive, according to the report.
Court filings cited by DOJ say victims spent heavily to repair and secure affected systems. One unnamed company allegedly lost about $35,000 a day for roughly six months, while a global NGO reported $480,000 in total losses after security upgrades, staff retraining and new monitoring tools.
The Justice Department’s release is available here.
This story draws on original reporting from The Record.
