Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison Swati KhandelwalOct 30, 2026Cyber Crime / Cyber Espionage Ahmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, the U.S. Justice Department said on October 29. The pro-Assad Syrian Electronic Army began its attacks in 2011. Its members sent phishing emails to steal employees' passwords, then used those passwords to deface websites, redirect web traffic, and hijack social media accounts, according to a 2014 FBI affidavit. On April 23, 2013, the group hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in two explosions at the White House. Twitter's message confirming a password reset for that account was sent to a Gmail account used primarily by Agha, the affidavit says. The Justice Department said Agha carried out that hack, which caused a temporary $136 billion drop in the value of stocks in the Dow Jones Industrial Average. Agha later told Business Insider that a big drop in the Dow "was our goal of that hack attack" and that "it was a big victory for us." Agha was first charged in June 2014 in a complaint that remained secret until March 2016. That month, the FBI added him and co-defendant Firas Dardar to its Cyber's Most Wanted list with a $100,000 reward. A federal grand jury indicted both men in May 2018. Court Watch reported in December 2025 that Agha was in U.S. custody and had appeared in federal court the month before. Three earlier public documents in the case do not describe Syrian officials organizing or leading the group: the 2014 FBI affidavit, the Justice Department's March 2016 announcement of the charges, and its May 2018 announcement of the indictment. In the 2016 announcement, the department said the group acted "in support of" the Syrian government. An early study of the group, published by the OpenNet Initiative, found no credible evidence directly linking the attackers to the Syrian government beyond the unspoken support any such group would need to operate on Syrian networks. In announcing the sentence, the department also said the conspiracy collected intelligence for Assad's government, which fell in December 2024. "Agha deployed his hacking skills in the service of Assad's regime to silence reporting on the regime's atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders," said John A. Eisenberg, Assistant Attorney General for National Security. In all, Agha hacked about 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies, the department said. He got into the company that hosted the U.S. Marine Corps recruiting website and redirected its visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. About 3,500 potential visitors saw that image instead of recruiting material. He also twice tried to take over the White House's social media accounts by stealing White House staff email passwords. Once, he got into staff email but failed to trick other staff into giving him access. The FBI affidavit describes the group breaking into a White House staff member's personal email account in July 2013 and says no official White House account was compromised. Many victims spent large sums on cleanup and security upgrades, according to court filings cited by the department. One company that supplies online publishers with content, ads, and links lost about $35,000 a day for about six months. A global non-profit group lost $480,000, including about $250,000 on new network monitoring tools, and had to retrain more than 800 staff members. Dardar remains a fugitive, the department said. He was also charged in a separate case with Peter Romar, a Syrian national then living in Germany. Romar was extradited to the U.S. and pleaded guilty in 2016. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Crime, cyber espionage, hacking, Nation-State, Phishing, Social Media Security New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Secure My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them