Syrian Hacker Sentenced in US After Over a Decade on the Run
A federal court in the Eastern District of Virginia has sentenced a central figure of the pro-Assad hacking group for a sweeping campaign targeting Western news outlets, businesses, and government entities.
Radwan AbdulhadiEditor and technology writer
Sentencing of a Key Syrian Electronic Army Figure
A Syrian man linked to the Syrian Electronic Army (SEA) has received a 42-month prison sentence in the United States, more than twelve years after he was initially <a href="https://www.securityweek.com/more-charges-against-syrian-electronic-army-hackers/">charged</a>. Ahmad Umar Agha, who operated under the online handle Th3Pr0, was sentenced by a federal court in the Eastern District of Virginia after evading American authorities for over a decade.
According to the Department of Justice, Agha played a central role in a cyber-conspiracy spanning from August 2011 through January 2024. Prosecutors detailed that the hacking operations were directed by individuals close to Syrian President Bashar al-Assad, which notably included the head of Syria’s General Intelligence Directorate.
High-Profile Intrusions and Economic Fallout
During the course of the conspiracy, Agha compromised approximately 47 targets consisting of Western news organizations, private companies, non-governmental organizations, and government bodies across the United States and allied nations. Among the most prominent operations highlighted by prosecutors was the <a href="https://www.securityweek.com/hackers-cause-stir-obama-injured-ap-tweet/">2013 takeover</a> of the Associated Press’s official Twitter account.
Using the compromised Associated Press account, Agha published a fabricated report claiming that then-President Barack Obama had been injured in dual explosions at the White House. The false report provoked a temporary flash crash that wiped $136 billion off the combined value of component stocks on the Dow Jones Industrial Average.
In addition to media targets, Agha gained unauthorized access to the infrastructure hosting the <a href="https://www.securityweek.com/us-marine-website-targeted-po-assad-hackers/">Marine Corps’ recruiting website</a>, redirecting web traffic to display an image encouraging Marines to defy military orders. He also targeted White House social media assets by aiming at the email credentials of White House employees, successfully obtaining credentials in one instance despite failing to trick other staff members into relinquishing their accounts.
Extensive Cleanup Costs and Financial Damage
The wide-scale campaign left many impacted victims facing severe financial burdens related to network cleanup and extensive security overhauls. A digital firm providing advertising, content, and outbound links to online publishers suffered losses estimated at roughly $35,000 per day over a period of six months.
Meanwhile, a global non-governmental organization spent approximately $250,000 implementing new network monitoring equipment, retraining upwards of 800 employees, and upgrading overall cybersecurity defenses, pushing its total recorded losses to about $480,000.
Decade-Long Manhunt and Legal Proceedings
Agha and an alleged accomplice, Firas Dardar, faced initial criminal complaints in June 2014. The case was officially unsealed in March 2016 when the FBI added both men to its Cyber’s Most Wanted list, posting a financial reward of up to $100,000 for information leading directly to Agha's capture. A federal grand jury subsequently indicted the pair in May 2018.
While Dardar remains at large, Agha's eventual <a href="https://www.courtwatch.news/p/the-rabbit-hole-fbi-s-most-wanted-faces-charges-in-virginia">appearance in a federal courtroom</a> took place in late 2025, an event initially brought to light by legal news publication Court Watch. The Department of Justice announcement did not specify the exact location or method by which Agha was taken into custody.
Sources
- SecurityWeekSyrian Hacker Gets Prison Time in US After Over a Decade on the Run
Continue chronologically
Related stories
OpenAI Engineer Arrested for Planting Hidden Office Recording Device
An OpenAI engineer has been arrested and charged by the U.S. Department of Justice for allegedly hiding a recording device in a company conference room.
Engineer Sentenced to Prison for Insider Cyber Extortion Plot
A former core infrastructure engineer has been sentenced to 32 months in federal prison for sabotaging his employer's industrial network.
US Arrests Tech CEO Over $300M Nvidia Chip Smuggling Scheme
Federal authorities have arrested California tech CEO Greg Lui for allegedly smuggling over $300 million in restricted Nvidia chips to China.
Alleged Developer of Ploutus ATM Malware Appears in Court
The alleged creator of the Ploutus ATM malware, linked to millions in jackpotting attacks, has appeared in a U.S. court following his arrest.
