A U.S. federal court has sentenced **Ahmad Umar Agha**, a Syrian Electronic Army hacker known online as "**Th3Pr0**," to 42 months in prison. The sentencing comes for his involvement in a wide-ranging hacking conspiracy targeting Western news outlets, businesses, and government bodies. The U.S. Justice Department revealed that the conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate. ### The Rise of the Syrian Electronic Army The pro-Assad **Syrian Electronic Army** commenced its operations in 2011. Its members primarily employed phishing tactics to steal employee credentials, subsequently using them to deface websites, redirect web traffic, and hijack social media accounts. An **FBI** affidavit from 2014 detailed these methods.  One of the group's most notable attacks occurred on April 23, 2013, when they hijacked the **Associated Press's** Twitter account. They posted a false report claiming President Barack Obama had been injured in White House explosions. The password reset for that account was sent to a Gmail address primarily used by Agha. The Justice Department confirmed Agha's role in this specific hack, which caused a temporary **$136 billion** drop in the **Dow Jones Industrial Average**. Agha later boasted to Business Insider that this significant market disruption was a primary objective and a "big victory" for the group. ### Pursuit and Capture Agha was initially charged in June 2014, with the complaint remaining sealed until March 2016. That same month, the **FBI** added him and co-defendant **Firas Dardar** to its Cyber's Most Wanted list, offering a **$100,000** reward. A federal grand jury formally indicted both men in May 2018. Court Watch reported in December 2025 that Agha was in U.S. custody and had appeared in federal court the previous month. Earlier public documents, including the 2014 FBI affidavit and Justice Department announcements from 2016 and 2018, had previously stated the group acted "in support of" the Syrian government, rather than being organized and led by officials. An early study by the **OpenNet Initiative** also found no credible direct links between the attackers and the Syrian government, beyond the implicit support required for such operations within Syrian networks. ### Intelligence Gathering and Disruptive Operations In announcing the sentence, the Justice Department clarified that the conspiracy also collected intelligence for Assad's government. John A. Eisenberg, Assistant Attorney General for National Security, stated, "Agha deployed his hacking skills in the service of Assad's regime to silence reporting on the regime's atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders." In total, Agha is implicated in hacking approximately 47 Western media outlets, businesses, non-profit organizations, and U.S. and allied government bodies. Among his actions, he breached the company hosting the **U.S. Marine Corps** recruiting website, redirecting visitors to an image urging Marines to refuse orders and join the Syrian Army. Around 3,500 potential recruits were exposed to this propaganda instead of official recruiting material. Agha also attempted twice to seize control of the White House's social media accounts by targeting staff email passwords. While he gained access to staff email on one occasion, he failed to trick other personnel into granting him full access to official White House accounts. The FBI affidavit confirmed a breach of a White House staff member's personal email in July 2013 but noted that no official White House accounts were compromised. ### Significant Financial Fallout The cyberattacks inflicted substantial financial damage on the victims. Court filings cited by the Justice Department show that one company providing content, ads, and links to online publishers lost approximately **$35,000 per day** for about six months. A global non-profit organization incurred **$480,000** in losses, including **$250,000** on new network monitoring tools, and had to retrain over 800 staff members. **Firas Dardar** remains a fugitive. He was also charged in a separate case alongside **Peter Romar**, a Syrian national then residing in Germany. Romar was extradited to the U.S. and pleaded guilty in 2016.