In April 2013, the Associated Press's Twitter account posted that explosions had gone off at the White House. The post was false, but the Justice Department says it caused a flash crash, a temporary $136 billion drop in the value of stocks making up the Dow Jones Industrial Average. The sentencing came more than thirteen years later.

On October 29, 2026, a federal judge in the Eastern District of Virginia (EDVA) sentenced one of the men prosecutors tie to that hijack. According to the DOJ, Ahmad Umar Agha, who went by "Th3Pr0" online, received 42 months in prison for his role in a long hacking conspiracy carried out for the government of former Syrian President Bashar al-Assad.

A hacking crew run by a regime

The public knew the group as the Syrian Electronic Army. The Justice Department describes it as something more organized than a loose hacktivist crew. Its release says the conspiracy ran from as early as August 24, 2011 to January 31, 2014, and was led by members of Assad's inner circle, including the commander of Syria's General Intelligence Directorate.

(One note on dates: Help Net Security's report gives the end of the conspiracy as January 2024. The DOJ release says January 31, 2014, and we are using the DOJ's date.)

The DOJ says the group went after about 47 targets: Western media outlets, businesses, non-governmental organizations, and US and allied government entities. Prosecutors list several aims. The conspiracy penalized the free press for reporting on the former Syrian government's atrocities, used information warfare to cause fear and confusion among the government's opponents, collected intelligence, and attempted to cause mutiny or refusal of duty among US military members.

The release quotes Assistant Attorney General John A. Eisenberg, First Assistant US Attorney Theophani Stamos, and Brett Leatherman, Operations Director of the FBI's Cyber Branch, on the sentencing.

How the attacks worked

As The Hacker News describes it, citing a 2014 FBI affidavit, the group sent phishing emails to steal employees' passwords. Phishing here means fake login pages and lure emails built to trick people into typing in their credentials. With those passwords, the group defaced websites, redirected traffic, and hijacked social media accounts.

The Record points to two cases that show how far one stolen login could go:

  • The AP account. A 2014 FBI affidavit, as reported by The Record, says Twitter's password-reset message for the AP account went to an email address Agha used. The Hacker News adds that the message went to a Gmail account used primarily by Agha. The DOJ attributes the AP hack to Agha.
  • A Marine Corps recruiting site. According to the DOJ, Agha obtained access to the company hosting the Marine Corps recruiting website and redirected visitors to an image urging Marines to refuse their orders and fight alongside the Syrian Army. The DOJ says about 3,500 potential visitors saw it. That fits the DOJ's statement that one goal was to cause mutiny among US service members.

One fake post from a trusted news account, according to the DOJ, was enough to move the market. The attackers borrowed a credible voice.

A decade on the run

Agha was out of reach of US courts for a long time. The Hacker News lays out the timeline:

  • June 2014: Agha is first charged by criminal complaint.
  • March 2016: The complaint is unsealed. The Record reports that the FBI also added Agha and co-conspirator Firas Dardar to its Cyber's Most Wanted list that year, with a $100,000 reward.
  • May 2018: Agha is indicted.
  • 2025: Agha is taken into US custody, according to The Record, which says the DOJ has not given details of his arrest. The Hacker News notes that Court Watch reported in December 2025 that he was in US hands.
  • October 29, 2026: Sentenced to 42 months in EDVA.

The sources do not say how Agha ended up in US custody. The Record reports that Dardar remains a fugitive.

Why a 42-month sentence matters

Three and a half years may look light next to a $136 billion market swing. But that loss was temporary, and the case was always about more than one bad post. Its weight comes from how long it took. US prosecutors charged a state-directed hacker, waited more than a decade, and still got a sentence once he was in custody. Charges against foreign government hackers can look symbolic when the people charged are out of reach. This case shows that such charges can still end in a courtroom, even years later.

The attribution also deserves attention. In the DOJ's account, this was not a group of patriotic volunteers who happened to support the regime. The department says it was organized and led by members of Assad's inner circle, including the commander of Syria's General Intelligence Directorate. That is the DOJ's account, and The Hacker News notes that earlier public documents in the case (the 2014 FBI affidavit and the 2016 and 2018 DOJ announcements) did not describe Syrian officials organizing or leading the group. The 2016 announcement said the group acted "in support of" the Syrian government, and an early OpenNet Initiative study found no credible evidence directly linking the attackers to the government. Treat the degree of state direction as the prosecutors' position.

What It Means for Defenders

This case has no CVE, no patch, and no fixed software version. The sources describe stolen passwords, including from phishing, and a password-reset message sent to an address the attacker used. That makes it a lesson about identity security, and it applies to any organization whose website or social accounts carry public trust.

Who should pay attention: newsrooms and communications teams, any company whose social accounts could move a stock price or cause panic, government agencies and contractors (including those working through CMMC), NGOs, and the agencies or vendors that host websites for any of them.

  • Treat official social accounts as critical systems. According to the FBI affidavit cited by The Record, Twitter's password-reset message for the AP account went to an address Agha used. Check which email address and phone number can recover each brand account. Make sure those belong to an organization-controlled, monitored mailbox with strong protection, not a personal inbox or a shared one nobody watches.
  • Use multi-factor authentication that resists phishing. The group's main tool, per The Hacker News, was phishing employees for passwords. Hardware security keys or passkeys stop a stolen password from being enough on its own. Codes sent by SMS or typed in by hand are better than nothing, but a convincing fake login page can still capture them.
  • Lock down where your web traffic goes. The DOJ's account of the redirected Marine Corps recruiting site, reached through its hosting company, is a reminder that your hosting provider, DNS provider and domain registrar accounts are part of your attack surface. Protect them with strong MFA and registrar locks, and limit who has admin access.
  • Rotate credentials after any phishing report. If an employee may have entered a password on a suspicious page, reset it, revoke active sessions, and review the account's recent activity. Don't wait to find out whether it was used.
  • Train people on the lure as well as the link. The group targeted employees at media outlets, businesses and agencies. Security awareness training should cover fake login pages and urgent-sounding messages, and it should make reporting a suspicious email quick and free of blame.
  • Have a plan for account hijacking. Know in advance who contacts the platform, who posts the correction, and how fast you can confirm a post was fake. In 2013 a single false post was followed by a temporary $136 billion drop in Dow stocks, so your response has to be fast.

The main takeaway from the Syrian Electronic Army case is that, per the FBI affidavit cited by The Hacker News, defacements, redirected traffic and account hijackings followed from phishing for employee passwords. That risk is still the same today.

Sources