Assad regime hacker who caused $136 billion market drop sentenced to 42 months
A Syrian man who used a hijacked news agency Twitter account to post a fake report of explosions at the White House has been sentenced to 42 months in prison, the US Department of Justice has announced.
Ahmad Umar Agha, also known as “Th3Pr0”, was sentenced on Thursday by a federal court in the Eastern District of Virginia for his central role in a hacking conspiracy organized and led by members of former Syrian President Bashar Al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate.
The scheme ran from as early as August 2011 until January 2024, and Agha spent more than a decade on the run.
Punishing the press
To spread the regime’s propaganda, Agha hacked approximately 47 Western media outlets, businesses, NGOs, and US and allied government entities.
Prosecutors say the conspiracy punished the free press for reporting on the regime’s atrocities during the Arab Spring and the Syrian Civil War that followed.
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg.
The tweet that shook the Dow
On April 23, 2013, the Syrian used his access to the Twitter account of a widely respected news agency to post a false claim that President Obama had been injured in two explosions at the White House. The post caused a temporary $136 billion drop in the value of the stocks that make up the Dow Jones Industrial Average.
He later bragged about the hack in an interview with Business Insider, saying that a steep fall in the Dow “was our goal of that hack attack” and that “it was a big victory for us.”
Marines told to switch sides
Agha broke into the company hosting the US Marine Corps’ recruitment website and redirected visitors to a server displaying an image that urged Marines to refuse their orders and fight alongside the Syrian Army. During the attack, approximately 3,500 potential visitors saw that image in place of recruitment material.
On two occasions, he tried to take over the White House’s social media page by stealing usernames and passwords for the email accounts of White House staff. One of those attempts succeeded, and he used the access in a failed bid to trick other staffers into handing over the White House’s social media accounts.
Costly cleanup for victims
Court filings show that several victims had to spend significant sums cleaning up after the intrusions or restructuring their security.
One company that supplies online publishers with content, website ads and links to other sites lost about $35,000 a day for around six months. A global NGO had to deploy a new set of network monitoring products costing around $250,000, retrain more than 800 staff members and upgrade its security system, bringing its total losses to $480,000.
“This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” noted First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia.
Agha and his coconspirator Firas Dardar were first charged by complaint in June 2014 and indicted in May 2018.
Dardar, who remains a fugitive, was charged in a separate conspiracy in September 2015, alongside Peter Romar, a Syrian national then living in Germany. Romar was extradited from Germany and pleaded guilty in September 2016.
