The Hacker Behind the Fake AP Tweet That Rattled Wall Street Gets 42 Months: The Syrian Electronic Army Case File
Ahmad Umar Agha, known as “Th3Pr0,” was sentenced in Virginia to 42 months in prison for Syrian Electronic Army attacks on about 47 Western targets, including the 2013 hijack of the Associated Press Twitter account. The victims’ cleanup bills are the part small businesses should study.
In 2013, a single false post from the Associated Press’s Twitter account claimed President Barack Obama had been hurt in two explosions at the White House. The hoax set off a flash crash that briefly erased about $136 billion in value from the stocks that make up the Dow Jones Industrial Average. More than twelve years after he was first charged, one of the men behind that hoax has been sentenced.
This case file draws on SecurityWeek’s account of the sentencing and reporting by The Record.
The defendant
Ahmad Umar Agha, who went by “Th3Pr0” online, was sentenced on Thursday, October 29, in federal court in the Eastern District of Virginia to 42 months in prison. The Justice Department described him as a central figure in the Syrian Electronic Army, a hacking group that worked in support of Bashar al-Assad. Prosecutors say the conspiracy was directed by people close to Assad, including the head of Syria’s General Intelligence Directorate. Assad’s government fell in 2024.
The operation
According to SecurityWeek, the scheme ran from as early as August 2011 until January 2024. Agha compromised about 47 targets, including Western news organizations, companies, nonprofits and government bodies in the United States and allied countries. The Justice Department also said the conspiracy gathered intelligence for the Assad government.
The AP takeover is the best-known episode. A 2014 FBI affidavit cited by The Record says Twitter’s confirmation of a password reset on the account went to an email address Agha used. In another attack, Agha got into the company that hosted the U.S. Marine Corps recruiting website and redirected its visitors to a message urging Marines to disobey orders. He also went after the White House’s social media presence twice by targeting staff email credentials. Once he obtained them, but his attempt to use that access to trick other staff into handing over accounts failed.
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders.” — John Eisenberg, Assistant Attorney General for National Security, as quoted by The Record
The bill the victims paid
- A company that supplies online publishers with content, advertising and outbound links lost about $35,000 a day for roughly six months.
- A global nonprofit spent about $250,000 on new network monitoring tools, retrained more than 800 employees and upgraded its security, with total losses of $480,000.
The long road to court
- June 2014: Agha and alleged accomplice Firas Dardar are charged by criminal complaint.
- March 2016: the case is unsealed and the FBI adds both men to its Cyber’s Most Wanted list, with a reward of up to $100,000 for information leading to Agha’s arrest.
- May 2018: a federal grand jury indicts the pair.
- November 2025: Agha appears in federal court, as first reported by Court Watch. The Justice Department has not said how or where he was taken into custody.
- October 29, 2026: sentenced to 42 months. Dardar is still at large.
What this means for your company
The headline attacks were not technically exotic. They came down to an email account, a password reset and a hosting provider. That is the same terrain every small business stands on. Your social media accounts, your website host and the email addresses tied to them are part of your security perimeter. Protect them with strong multi-factor sign-in, limit who can reset passwords, review which outside companies can change your website, and agree on how you would quickly correct a false post. The victims’ costs show that recovery, retraining and lost revenue usually cost far more than prevention would have.
Want to know whether your social accounts, website host and admin email could be hijacked the same way? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
