Hacker Who Served Assad Circle Sentenced to 42 Months
Ahmad Umar Agha, 42, hacked about 47 organizations for a ring tied to Assad's inner circle. His intrusions included the 2013 fake AP post that briefly erased $136 billion in market value.
Ahmad Umar Agha, a 42-year-old Syrian man, was sentenced on Thursday to 42 months in federal prison. Prosecutors describe him as a central figure in a hacking operation run from former President Bashar Assad's inner circle.
The Justice Department says Agha carried out the conspiracy from at least Aug. 24, 2011, until Jan. 31, 2024. Members of Assad's circle organized and led the operation, among them the commander of Syria's General Intelligence Directorate.
Who was targeted and why
Agha hacked roughly 47 media outlets, businesses, nongovernmental organizations and US and allied government bodies, prosecutors said. They listed several motives. One was punishing news organizations that reported on Syrian government atrocities during the Arab Spring and the civil war that followed. Others were spreading fear among the regime's opponents, collecting intelligence and persuading members of the US military to refuse their orders.
The most damaging intrusion came on April 23, 2013. Prosecutors said Agha got into the Twitter account of the Associated Press and posted a false claim that President Barack Obama had been injured in two explosions at the White House. The post set off a flash crash that briefly wiped $136 billion from the stock market.
In another case, Agha, who used the handle "Th3 Pr0," compromised the company hosting the US Marine Corps recruitment website. About 3,500 visitors were redirected to an image urging Marines to refuse orders and fight alongside the Syrian Army. On two occasions he stole usernames and passwords for White House staff email accounts, trying to take over the White House's social media accounts. In one instance he succeeded, prosecutors said.
Losses and the wider case
One company that works with online publishers lost about $35,000 a day for roughly six months. A global nongovernmental organization spent about $250,000 on new network monitoring products, retrained more than 800 staff members and reported $480,000 in total losses.
Assistant Attorney General for National Security John A. Eisenberg said Agha "deployed his hacking skills in the service of Assad's regime to silence reporting on the regime's atrocities, intimidate its opponents, and incite US servicemembers to refuse their orders." First Assistant US Attorney Theophani K. Stamos of the Eastern District of Virginia said the case "emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States."
Agha and a co-conspirator, Firas Dardar, were first charged by criminal complaint on June 12, 2014, and indicted on May 17, 2018. Dardar remains a fugitive. In 2015 he was also charged in a separate conspiracy with Peter Romar, a Syrian national then living in Germany. That case involved computer intrusion, extortion, money laundering and violations of Syrian sanctions rules. Romar was extradited from Germany and pleaded guilty in 2016. Assad's regime collapsed in December 2024, and the former president fled the country.
Source: CyberScoop