Syrian Electronic Army hacker Ahmad Umar Agha sentenced to 42 months over 2013 AP Twitter hijack and intrusions into ~47 organizations
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 01/11/2026 00:01; os links antigos trazem para cá.
Fontes: securityweek.com ↗ cyberscoop.com ↗ thehackernews.com ↗
The U.S. Justice Department announced on October 29 that Ahmad Umar Agha (alias Th3Pr0 / Th3 Pr0), a Syrian Electronic Army (SEA) member, was sentenced to 42 months in federal prison for a hacking conspiracy against Western news outlets, businesses, non-profits and government bodies (thehackernews.com, cyberscoop.com). The sentence was handed down by a federal court in the Eastern District of Virginia. Agha, 42, was first charged in June 2014 and evaded US authorities for more than a decade (securityweek.com). He was behind the April 23, 2013 hijack of the Associated Press Twitter account, which posted a false report of White House explosions injuring President Obama and briefly wiped about $136 billion from the Dow Jones Industrial Average. Prosecutors say he compromised roughly 47 organizations between August 2011 and January 2024 (cyberscoop.com, securityweek.com). Victims included the host of the U.S. Marine Corps recruiting website, where about 3,500 visitors were redirected to propaganda urging Marines to refuse orders. He also twice targeted the White House's social media presence through staff email credentials; he obtained credentials in one case, but his attempt to use them to trick other staffers into handing over accounts failed (securityweek.com). DOJ says the conspiracy was organized and led by members of Bashar al-Assad's inner circle, including the head or commander of Syria's General Intelligence Directorate. Co-defendant Firas Dardar remains a fugitive, and Peter Romar pleaded guilty in 2016 after extradition from Germany (cyberscoop.com). The DOJ announcement does not say how or where Agha was taken into custody; a federal court appearance in November 2025 was first reported by Court Watch (securityweek.com).
Detalhes técnicos
- The SEA, active since 2011, relied on phishing emails to harvest employee credentials. These were reused to deface websites, redirect traffic and hijack social media accounts (thehackernews.com).
- In the AP case, Twitter's password-reset confirmation went to a Gmail account primarily used by Agha (thehackernews.com).
- The Marine Corps redirect was achieved by compromising a third-party web hosting provider and injecting a redirect (cyberscoop.com); the traffic was redirected to an image urging Marines to defy their orders (securityweek.com).
- A White House staff member's personal email account was breached in July 2013, but no official White House account was compromised (thehackernews.com). The follow-on attempt to trick other staffers into handing over official accounts failed (securityweek.com).
- Stated motives were information operations: suppressing reporting on regime atrocities, intimidation, intelligence collection, and influence operations against US servicemembers (cyberscoop.com).
- Victim losses: a content, advertising and outbound-link (publisher-services) supplier for online publishers lost about $35,000 a day for roughly six months. A global non-profit/NGO lost $480,000, including $250,000 on network monitoring tools and retraining of 800+ staff, plus security upgrades (all three sources).
- Case history (securityweek.com): criminal complaint in June 2014; unsealed in March 2016, when the FBI added Agha and Dardar to its Cyber's Most Wanted list with a reward of up to $100,000; indictment in May 2018; federal court appearance in November 2025.
Relatos divergentes
- Attribution wording: thehackernews.com notes that DOJ's claim of leadership by Assad's inner circle and the General Intelligence Directorate commander is absent from the 2014 FBI affidavit and the 2016/2018 DOJ announcements, which only said the group acted "in support of" the Syrian government. The DOJ announcement of October 29 is the most recent and authoritative statement. cyberscoop.com reports the stronger claim without that historical caveat, and securityweek.com repeats it, citing DOJ, and refers to the head of the directorate.
- Victim scope: thehackernews.com describes the roughly 47 victims generally as outlets, businesses, non-profits and government bodies. cyberscoop.com describes them as media organizations, businesses, NGOs, and US and allied government entities, and gives the activity span (August 2011 to January 2024), which thehackernews.com does not. securityweek.com gives the same span and the same US and allied scope.
- White House accounts: cyberscoop.com reports that Agha used stolen White House staff credentials twice in attempts to take over official accounts. securityweek.com is more specific: he targeted the White House twice, obtained credentials in only one case, and the takeover attempt failed. thehackernews.com says a staffer's personal email was breached in July 2013 and no official account was compromised. The record follows the more specific account.
- Handle spelling: thehackernews.com and securityweek.com write "Th3Pr0" and cyberscoop.com writes "Th3 Pr0"; this is the same alias.
Linha do tempo
-
Syrian Electronic Army hacker Ahmad Umar Agha (Th3Pr0) sentenced to 42 months in US prison after a decade as a fugitive
ler a análise desta fonte ocultar
A federal court in the Eastern District of Virginia sentenced Ahmad Umar Agha, alias Th3Pr0, to 42 months in prison for his role in a hacking conspiracy tied to the Syrian Electronic Army (SEA). Agha was first charged in June 2014 and evaded US authorities for more than a decade. According to the DOJ, the conspiracy ran from August 2011 to January 2024 and was directed by figures close to Bashar al-Assad, including the head of Syria's General Intelligence Directorate. Agha compromised around 47 targets, including Western news outlets, companies, NGOs and government bodies in the US and allied countries. His alleged accomplice, Firas Dardar, remains at large.
Technical Details
- The 2013 takeover of the Associated Press Twitter account was used to post a fake report that President Obama had been injured in White House explosions. It triggered a flash crash that briefly erased $136 billion from the combined value of the Dow Jones Industrial Average's component stocks.
- Agha gained access to the company hosting the Marine Corps' recruiting website and redirected its traffic to an image urging Marines to defy their orders.
- He twice targeted the White House's social media presence by going after employee email credentials. In one case he obtained them, but his attempt to use that access to trick other staffers into handing over the accounts failed.
- Victims reported heavy costs. A content, advertising and outbound-link provider for online publishers lost about $35,000 per day for roughly six months. A global NGO spent about $250,000 on network monitoring tools, retrained more than 800 employees and upgraded its security, for total losses of $480,000.
- Timeline: criminal complaint in June 2014, unsealed in March 2016 when the FBI added Agha and Dardar to its Cyber's Most Wanted list with a reward of up to $100,000, indictment in May 2018, and a federal court appearance in November 2025 first reported by Court Watch. The DOJ announcement does not say how or where Agha was taken into custody.
-
Syrian Electronic Army hacker Ahmad Umar Agha sentenced to 42 months for AP Twitter hoax and US government intrusions
ler a análise desta fonte ocultar
Ahmad Umar Agha, 42, a Syrian national who used the handle "Th3 Pr0", was sentenced to 42 months in US federal prison for a hacking conspiracy run on behalf of the inner circle of former Syrian President Bashar Assad, including the commander of Syria's General Intelligence Directorate. Prosecutors said Agha compromised roughly 47 media organizations, businesses, NGOs, and US and allied government entities between August 2011 and January 2024. The most notable intrusion was the April 23, 2013 takeover of the Associated Press Twitter account, which posted a false claim that President Obama had been injured in White House explosions and triggered a flash crash that briefly wiped $136 billion from US markets. He also compromised the host of the US Marine Corps recruitment website, redirecting ~3,500 visitors to propaganda urging Marines to refuse orders, and twice stole White House staff email credentials in attempts to seize official social media accounts. Coconspirator Firas Dardar remains a fugitive; Peter Romar pleaded guilty in 2016 after extradition from Germany.
Technical Details
The campaign relied on credential theft against staff email accounts and account takeover of corporate and government social media profiles, plus compromise of a third-party web hosting provider to inject a redirect on the Marine Corps recruitment site. Motives were information operations: suppressing reporting on regime atrocities, intimidation, intelligence collection, and influence operations against US servicemembers. Victim losses included one publisher-services firm losing ~$35,000/day for roughly six months, and an NGO incurring $480,000 in total losses, $250,000 in new network monitoring tooling, and retraining of 800+ staff.
-
Syrian Electronic Army hacker Ahmad Umar Agha sentenced to 42 months over AP Twitter hijack that wiped $136B
ler a análise desta fonte ocultar
The U.S. Justice Department announced on October 29 that Ahmad Umar Agha, aka "Th3Pr0", a member of the Syrian Electronic Army (SEA), was sentenced to 42 months in prison for a hacking conspiracy targeting Western news outlets, businesses, non-profits and government bodies. Agha was behind the April 23, 2013 hijack of the Associated Press Twitter account, which posted a false report of explosions at the White House injuring President Obama and caused a temporary $136 billion drop in the Dow Jones Industrial Average. DOJ states the conspiracy was organized and led by members of Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate — a claim absent from the 2014 FBI affidavit and the 2016/2018 DOJ announcements, which only said the group acted "in support of" the Syrian government. In total Agha compromised roughly 47 organizations, including the host of the U.S. Marine Corps recruiting website, redirecting ~3,500 visitors to propaganda urging Marines to refuse orders, and twice attempted to take over White House social media accounts via stolen staff email credentials. Co-defendant Firas Dardar remains a fugitive; Peter Romar pleaded guilty in 2016.
Technical Details
The SEA's tradecraft, active since 2011, relied on phishing emails to harvest employee credentials, which were then reused to deface websites, redirect web traffic and hijack social media accounts. In the AP case, Twitter's password-reset confirmation was sent to a Gmail account primarily used by Agha. The group also breached a White House staff member's personal email account in July 2013, though no official White House account was compromised. Victim losses included one content/ad supplier losing roughly $35,000 a day for six months and a global non-profit losing $480,000, including $250,000 on network monitoring tools and retraining of 800+ staff.