Th3Pr0 sentenced to 42 months for central role in Assad-linked hacking conspiracy

A federal court sentenced Ahmad Umar Agha, also known as Th3Pr0, to 42 months in federal prison on Oct. 29, 2026, in the Eastern District of Virginia for his central role in a hacking conspiracy tied to the former Assad regime.

Members of Bashar al-Assad’s inner circle organized the conspiracy, and the commander of Syria’s General Intelligence Directorate played a role in running it. It operated from Aug. 24, 2011, to Jan. 31, 2024, and targeted Western media outlets, businesses, nongovernmental organizations and U.S. government entities to spread propaganda for the Syrian government.

Agha hacked approximately 47 Western media outlets, businesses, NGOs and U.S. and allied government entities. The attacks sought to silence reporting on the regime’s atrocities during the Arab Spring and the Syrian Civil War. The operation served the conspiracy’s broader goal of spreading propaganda for the Assad regime.

The false White House report appeared on April 23, 2013, when Agha took over the Associated Press’s compromised Twitter account and claimed explosions had injured President Barack Obama. He also attempted twice to seize control of the White House’s own social media accounts by stealing usernames and passwords from staff e-mail accounts. One attempt succeeded, but he failed to trick other staff into handing over full access.

The Dow Jones Industrial Average fell temporarily by $136 billion after the false tweet. Agha said in a 2013 interview with Business Insider that causing the market drop was the goal and called the attack a ‘big victory’ for the Assad regime.

An image telling Marines to disobey orders and fight beside the Syrian Army appeared on the U.S. Marine Corps recruitment website after Agha breached it and redirected roughly 3,500 visitors. The attack occurred during the conspiracy’s years of operations. Victims incurred costs for monitoring networks, retraining staff and upgrading security systems; one company lost about $35,000 per day for six months, and an NGO spent $480,000 on security upgrades.

Charges came in June 2014, and an indictment followed in May 2018, for Agha and his co-conspirator Firas Dardar. A separate conspiracy charge in September 2015 named Dardar and Peter Romar, a Syrian citizen in Germany, and accused them of extortion, money laundering and violating Syrian sanctions. Dardar remains a fugitive.

Agents from the FBI’s Washington Field Office and the Cyber Division worked the case for over a decade, leading to Agha’s capture and sentencing.

John A. Eisenberg, the assistant attorney general for national security, said Agha’s hacking was an assault on the free press and on U.S. national and economic security. He emphasized the National Security Division’s long-term pursuit of state-sponsored hackers.

Members of the Syrian Computer Society, an organization controlled by the Assad family, founded the Syrian Electronic Army in 2011, and the group operated under the regime’s protection. Phishing e-mails, fake login pages and social engineering were the Syrian Electronic Army’s tools for compromising accounts and spreading disinformation, with journalists, IT teams and executives among the personalized targets. The group also hunted for weakly updated content management systems, including WordPress and Joomla, and used them to deface websites.

BlackWorm RAT, a remote access trojan, was one piece of malware the Syrian Electronic Army built for spying on dissidents and gathering sensitive data; it could disable firewalls, collect geolocation data and spread across networks. The Syrian Electronic Army turned from hacking to information warfare and propaganda after 2017, building fake news accounts aimed at Syrian opposition groups, the White Helmets and Kurdish fighters. The shift marked a move away from direct intrusions toward broader disinformation campaigns.

The Syrian Electronic Army’s most infamous attack was the 2013 hack of the Associated Press’ Twitter account. Prosecutors pursued the case through the Eastern District of Virginia, and Agha’s sentencing concluded more than a decade of U.S. prosecution.