Syrian Hacker Sentenced After 12 Years on the Run

A U.S. federal court sentenced Syrian hacker Ahmad Umar Agha to 42 months in prison on Thursday after he evaded authorities for more than 12 years. Prosecutors linked him to a hacking campaign that compromised about 47 targets, including news organizations, companies, nongovernmental groups and government bodies in the United States and allied countries.

Agha, who used the online name Th3Pr0, was associated with the Syrian Electronic Army. He was sentenced in the Eastern District of Virginia. The Justice Department said the conspiracy began as early as August 2011 and continued through January 2024.

Prosecutors said the operation was directed by people close to former Syrian President Bashar al-Assad, including the head of Syria’s General Intelligence Directorate. The Justice Department described Agha as a central participant in the campaign.

In April 2013, hackers took control of the Associated Press’ Twitter account. Agha used it to post a false report claiming that then-President Barack Obama had been injured in two explosions at the White House. The post briefly triggered a market plunge that erased about $136 billion from the combined value of companies in the Dow Jones Industrial Average.

Agha also breached the company hosting the U.S. Marine Corps’ recruiting website and redirected visitors to an image urging Marines to disobey their orders. Prosecutors said he targeted the White House’s social media operations twice by trying to obtain the email credentials of White House employees. He obtained credentials in one case but failed to use them to trick other employees into giving up access to their accounts.

The attacks imposed costs on victims. A company that provided online publishers with content, advertising and outbound links lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on network monitoring tools, employee training and security upgrades. Its total losses were estimated at $480,000.

U.S. authorities first charged Agha and alleged accomplice Firas Dardar in a criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI added both men to its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest. A grand jury indicted them in May 2018.

Dardar has not been arrested. Agha appeared in a U.S. federal courtroom in November 2025 after more than a decade outside American custody. The Justice Department did not disclose how or where he was taken into custody.