A US court jailed Ahmad Umar Agha for 42 months over a pro-Assad hacking campaign, including the 2013 fake tweet that briefly wiped $136bn off stocks.
A US federal court has sentenced a Syrian hacker to 42 months in prison. More than a decade ago he used a hijacked news agency Twitter account to falsely report explosions at the White House, and the post briefly erased an estimated $136 billion from the stocks in the Dow Jones Industrial Average. The US Department of Justice announced on October 29 that Ahmad Umar Agha, known online as "Th3Pr0," was sentenced in the Eastern District of Virginia. Help Net Security and The Hacker News both reported the news. Prosecutors now say the hacking campaign was organised and led by members of former Syrian President Bashar al-Assad's inner circle. That framing goes further than the government's earlier public statements on the case.
Agha was a member of the Syrian Electronic Army, a pro-Assad hacking group. According to a 2014 FBI affidavit cited by The Hacker News, the group began its attacks in 2011. Help Net Security, citing the Justice Department, says the wider conspiracy ran from as early as August 2011 until January 2024.
The best-known incident took place on April 23, 2013. Agha used his access to a news agency's Twitter account to post a false claim that President Barack Obama had been hurt in two explosions at the White House. Help Net Security describes the victim only as a widely respected news agency. The Hacker News names it as the Associated Press. The FBI affidavit says Twitter's password-reset confirmation for that account went to a Gmail address used mainly by Agha. The fake report caused a temporary drop of about $136 billion in the value of Dow Jones stocks.
Agha later talked about the attack in an interview with Business Insider. He said a fall in the Dow had been the aim and that "it was a big victory for us."
The Justice Department lists several other intrusions:
Agha and co-defendant Firas Dardar were first charged by complaint in June 2014. The Hacker News reports that the complaint stayed sealed until March 2016. That month the FBI placed both men on its Cyber's Most Wanted list with a $100,000 reward. A federal grand jury indicted them in May 2018. Agha spent more than ten years as a fugitive. Court Watch reported in December 2025 that he was in US custody and had appeared in federal court the previous month. Neither outlet explains how he came to be detained.
The victims were mainly Western news organisations, along with businesses, non-governmental organisations (NGOs) and government entities in the US and allied countries. Prosecutors say the campaign was meant to punish journalists for reporting on the Assad regime's atrocities during the Arab Spring and the Syrian Civil War that followed.
Court filings cited by the Justice Department show the cost to some victims:
Investors were also briefly affected in 2013, when the fake tweet moved the market before the claim was shown to be false.
None of this required advanced technical tools. The 2014 FBI affidavit describes the Syrian Electronic Army's method in simple terms. Members sent phishing emails, which are messages designed to trick people into giving up their login details. They then used the stolen passwords to deface websites, redirect web traffic and take over social media accounts.
The Marine Corps incident shows a related weakness. Agha did not break into the Marines' own systems. He went after the hosting company behind the website. When the provider was compromised, he could send visitors to a page he controlled. This kind of third-party or supply-chain risk means an organisation's online presence is only as secure as the vendors it depends on.
The AP Twitter takeover also shows how much damage one account can do. A trusted news brand with a large audience can move markets within minutes. That gives attackers a strong reason to steal its password.
The incidents are historical, and this is a criminal sentencing, not a new vulnerability. No software flaw or CVE is involved. The case still matters because of the scale and duration of the campaign and because of the government's new account of who was directing it.
The two outlets agree on the main facts but differ in emphasis. Help Net Security repeats the Justice Department's statement that the conspiracy was organised and led by Assad insiders, including the commander of Syria's General Intelligence Directorate. The department also says the group gathered intelligence for the regime, which fell in December 2024.
The Hacker News adds important context. It says three earlier public documents in the case did not describe Syrian officials organising or leading the group: the 2014 FBI affidavit, the March 2016 charging announcement and the May 2018 indictment announcement. In 2016, the department said only that the group acted in support of the Syrian government. An early study of the group by the OpenNet Initiative found no credible evidence linking the hackers directly to the government, beyond the tacit approval any such group would need to operate on Syrian networks.
There is a second difference over the White House. The Justice Department says one attempt gave Agha access to staff email. The FBI affidavit, as reported by The Hacker News, describes a July 2013 break-in to a White House staff member's personal email account and says no official White House account was compromised.
There is also a small inconsistency about Peter Romar, a Syrian national living in Germany who was charged with Dardar in a separate September 2015 case. Help Net Security says Romar was extradited from Germany and pleaded guilty in September 2016. The Hacker News says only that he was extradited to the US and pleaded guilty in 2016.
The techniques in this case are still common. Based on the methods described in the sources, these are sensible steps:
For administrators and security teams:
For everyday users:
ITVedas analysis: A single stolen password once moved Wall Street by an estimated $136 billion, which remains one of the clearest cases of social media account security affecting financial markets. The Justice Department's stronger claims about state direction may be correct, but they deserve scrutiny until the supporting evidence is made public.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →