Syrian hacker sentenced for Assad regime cyber conspiracy

Ahmad Umar Agha, also known as Th3Pr0, has been sentenced by a federal district court in the Eastern District of Virginia to 42 months’ imprisonment for his central role in a wide-ranging hacking conspiracy conducted on behalf of the Bashar al-Assad regime.

The court heard that the operation, linked to members of Assad’s inner circle including the commander of Syria’s General Intelligence Directorate, ran from August 2011 to January 2014 and targeted about 47 Western media outlets, businesses, NGOs, and U.S. and allied government entities. Prosecutors said the campaign aimed to suppress reporting on the regime’s atrocities, spread disinformation and collect intelligence, while attempting to induce mutiny among U.S. service members.

The FBI said Agha’s actions demonstrated a direct assault on the free press and national security, with the case illustrating the risk posed by state-sponsored cyber activity.

Court filings detail several notable hacks and their consequences. Agha’s operations caused a global incident when a tweet attributed to a major news outlet falsely claimed President Obama was injured, contributing to a Dow Jones flash crash that briefly erased about $136 billion in stock value. Other impacts included a malware or defacement-linked intrusion that redirected visitors from the U.S.

Marine Corps’ recruitment site to an image urging Marines to refuse orders, affecting around 3,500 potential visitors; and efforts to seize control of the White House social media accounts. Dardar, Agha’s coconspirator, remains a fugitive. The FBI and DOJ lead the prosecution, with additional charges against linked actors and prior related cases noted in court records.