Syrian hacker sentenced for decade-long Assad-regime hacking campaign

Overview

Updated 2 hours ago

A federal court in Virginia sentenced Syrian hacker Ahmad Umar Agha to 42 months in prison on October 29, 2026. Agha, known online as Th3Pr0, ran phishing operations for Bashar al-Assad's regime. The conspiracy compromised 47 Western media, corporate, NGO, and government targets.

His most notorious attack came in April 2013, when he hijacked the Associated Press Twitter account and falsely reported President Obama was injured. The post erased $136 billion in Dow Jones value before markets recovered. Co-conspirator Firas Dardar remains at large.

Why it matters

A state-sponsored hacker who triggered a $136 billion market flash crash now faces prison, while his co-conspirator remains a fugitive.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

42 months

Prison sentence

Handed down October 29, 2026 in the Eastern District of Virginia.

Entities hacked

Western media, corporations, NGOs, and US and allied government agencies.

$136 billion

Temporary Dow value loss

Flash crash triggered by the April 2013 AP Twitter hack.

10+ years

Fugitive period

Agha evaded capture from his 2014 charges until before sentencing.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Ahmad Umar Agha

Senior hacker, Syrian Electronic Army

Sentenced to 42 months in prison

Firas Dardar

Co-conspirator, Syrian Electronic Army

Fugitive

Peter Romar

Co-conspirator, Syrian Electronic Army

Pleaded guilty in 2016

Organizations Involved

Syrian Electronic Army

Hacker collective

Several members prosecuted in US courts

A pro-Assad hacking group active since 2011 that targeted Western media and government sites.

U.S. Department of Justice

Federal agency

Prosecuted the case

Prosecuted the Syrian Electronic Army conspiracy in the Eastern District of Virginia.

Timeline

2011 October 2026

11 events Latest: Yesterday Showing 8 of 11

Tap a bar to jump to that date

October 2026
Sentencing
Latest Legal

Court sentences Agha to 42 months in prison.
Yesterday
January 2024
Conspiracy ends
Legal

Conspiracy period ends per court filings.
January 31st, 2024
May 2018
Indictment
Legal

Grand jury indicts Agha and Dardar on conspiracy and identity theft charges.
May 17th, 2018
September 2016
Romar pleads guilty
Legal

Peter Romar pleads guilty in Eastern District of Virginia.
September 28th, 2016
March 2016
Most wanted
Statement

FBI adds Agha and Dardar to Cyber's Most Wanted list.
March 22nd, 2016
September 2015
Related charges
Legal

Dardar and Romar charged in separate hacking conspiracy.
September 29th, 2015
June 2014
Criminal complaint
Legal

Agha charged by federal complaint in Eastern District of Virginia.
June 12th, 2014
April 2013
AP Twitter hack
Incident

Fake tweet about Obama injury triggers $136 billion Dow flash crash.
April 23rd, 2013
2013
Marines site defaced
Incident

US Marine Corps recruitment website redirects visitors to anti-mutiny image.
2013
August 2011
Campaign begins
Incident

Syrian Electronic Army launches hacking campaign targeting Western media and government sites.
August 24th, 2011
2011
White House targeted
Incident

Hackers gain access to Executive Office of the President computer systems.
2011

#timeline [x-show="expanded"] { display: revert !important; opacity: 1 !important; } #timeline .timeline-toggle-btn { display: none; }

Scenarios

Agha serves sentence without appeal

Likely Resolves by Nov 30, 2026

Discussed by: Standard federal criminal practice; most defendants do not appeal

Agha accepts the 42-month sentence. Federal criminal notices of appeal must be filed within 14 days of judgment, so the absence of an appeal by mid-November confirms this path. With credit for time served since his capture, his release date could come sooner than the nominal sentence end.

Agha appeals conviction or sentence

Possible Resolves by End of 2028

Discussed by: Defense bar standard practice for decade-old cases

Agha files a notice of appeal challenging his conviction or sentence. The Fourth Circuit Court of Appeals would hear the case, with a decision typically arriving in 12 to 18 months. Grounds could include evidentiary rulings, the long delay between charges and trial, or sentencing calculations.

Firas Dardar captured or surrendered

Uncertain Resolves by End of 2027

Discussed by: FBI Cyber's Most Wanted list

Dardar, Agha's co-conspirator known as THE SHADOW, remains at large. His arrest would require travel to a country willing to extradite him to the US, following the path that ended with Romar's extradition from Germany in 2016. The FBI's Cyber's Most Wanted list tracks his status.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

July 2018

Russian GRU indictments (2018)

Special Counsel Robert Mueller indicted 12 officers of Russia's GRU military intelligence agency for hacking the Democratic National Committee and the Clinton campaign during the 2016 election. The officers used spear-phishing and malware to steal emails and leak them through intermediaries.

Then

The officers remained in Russia and were never extradited to face trial.

Now

The case showed US prosecutors can charge state-sponsored hackers, but arrests depend on a suspect being reachable.

Why this matters now

Agha's sentencing shows the same pattern: US jurisdiction reached him only after he was captured and brought to Virginia. His co-conspirator Dardar, like the GRU officers, remains beyond US reach.

April 2017

Roman Seleznev sentencing (2017)

Roman Seleznev, a Russian hacker who stole and sold hundreds of thousands of credit card numbers, was captured in the Maldives in 2014 and sentenced to 27 years in a US federal prison in 2017. He had spent years operating from multiple countries.

Then

Seleznev received one of the longest cybercrime sentences in US history.

Now

His case established that the US will track and prosecute foreign hackers across borders, even after years on the run.

Why this matters now

Like Agha, Seleznev was a fugitive for years before US law enforcement caught up. Agha's capture and sentence extend that precedent to state-sponsored hackers.