Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Syrian Electronic Army Hacker Sentenced to 42 Months for the Fake AP Tweet That Rattled Markets

Ahmad Umar Agha, the Syrian Electronic Army operator known as Th3Pr0, has been sentenced to 42 months in a U.S. prison for a years-long phishing and account-hijacking campaign against Western media, businesses and government bodies, including the 2013 fake Associated Press tweet that briefly erased about $136 billion in stock-market value.

4T4Tify Team4Tify
Oct 30, 2026·6 min read
Syrian Electronic Army Hacker Sentenced to 42 Months for the Fake AP Tweet That Rattled Markets

Syrian Electronic Army Hacker Sentenced to 42 Months for the Fake AP Tweet That Rattled Markets

A U.S. federal court has sentenced Ahmad Umar Agha, a member of the pro-Assad Syrian Electronic Army who operated under the handle "Th3Pr0", to 42 months in prison. The sentence, announced by the U.S. Department of Justice on 29 October, closes a chapter that began more than a decade ago with phishing emails and ended with a hijacked Associated Press account moving the entire Dow Jones index.

What happened

The Syrian Electronic Army started its campaign in 2011. Its playbook was simple and effective: send phishing emails to employees of media outlets and other organisations, harvest their passwords, then use those credentials to deface websites, redirect traffic and seize control of social media accounts.

Its most infamous operation came on 23 April 2013, when the group took over the Associated Press's Twitter account and posted a false report that two explosions had hit the White House and injured President Barack Obama. Automated trading systems reacted within seconds. The Dow Jones Industrial Average briefly lost roughly $136 billion in value before the hoax was exposed and markets recovered. Investigators later tied the operation to Agha through the password-reset confirmation for the AP account, which landed in a Gmail inbox he primarily used. Agha himself later bragged that crashing the Dow had been the whole point.

In total, U.S. prosecutors say Agha compromised around 47 Western media outlets, businesses, non-profit groups and U.S. and allied government bodies. Among the other operations attributed to him:

  • Breaching the hosting provider behind the U.S. Marine Corps recruiting website and redirecting roughly 3,500 visitors to an image urging Marines to disobey orders and side with the Syrian army.
  • Two attempts to take over the White House's social media accounts by phishing staff email passwords. One attempt reached a staff member's personal inbox in July 2013, but no official White House account was compromised.

The financial fallout for victims was real. One company that supplies content, ads and links to online publishers lost around $35,000 a day for about six months. A global non-profit spent roughly $480,000 on the aftermath, including about $250,000 on new network monitoring tools and the retraining of more than 800 employees.

The long road to a courtroom

Agha was first charged in a sealed complaint in June 2014. The case became public in March 2016, when the FBI added him and co-defendant Firas Dardar to its Cyber's Most Wanted list with a $100,000 reward. A federal grand jury indicted both men in May 2018. Agha only entered U.S. custody in late 2025 and appeared in federal court in November of that year. Dardar remains a fugitive. A third man, Peter Romar, was extradited from Germany and pleaded guilty in 2016.

Notably, the sentencing announcement goes further on attribution than earlier filings. The Justice Department now describes the conspiracy as organised and led by members of Bashar al-Assad's inner circle, including the head of Syria's General Intelligence Directorate, and says the group collected intelligence for a regime that fell in December 2024. Earlier public documents in the case, including the 2014 FBI affidavit and the 2016 and 2018 charging announcements, described the group only as acting "in support of" the Syrian government. Whether the group was directly state-run or a tolerated proxy was long debated, so the new characterisation is best read as the prosecution's current position rather than a settled fact.

Why it matters

Thirteen years on, the AP hack remains the clearest demonstration of how a single stolen password can turn into a macroeconomic event. Nothing in the attack was technically sophisticated. There was no zero-day and no malware implant, just a convincing email and an employee who clicked. The lesson has not aged: the weakest link in most organisations is still a reused or phished credential, and the blast radius of a compromised corporate social account is far larger than the account itself.

The case also shows how slowly justice moves in state-aligned cybercrime. Agha was identified within a year of the AP hack but spent more than a decade beyond reach, and his co-defendant still is.

What to do

  • Harden every high-impact account. Corporate social media, domain registrar, DNS and email admin accounts belong behind phishing-resistant multi-factor authentication such as hardware keys or passkeys, not SMS codes.
  • Centralise control of brand accounts. Use a social media management platform so individual staff never hold the master password, and review who has access every quarter.
  • Train for the realistic scenario. The Syrian Electronic Army's emails impersonated colleagues and familiar services. Phishing simulations should mirror that, not generic prize-draw lures.
  • Watch for credential leaks. Passwords harvested in a phishing wave are often traded or dumped long before they are used. Knowing when your staff credentials surface in criminal marketplaces or paste sites gives you a window to reset them first. 4tify's Deep/Dark Web monitoring is built for exactly that: continuous watch over leak sources for your domains and identities, with alerts before an exposed credential becomes an account takeover.
  • Prepare the response playbook. Decide in advance who can lock a hijacked account, who speaks to the press and how you flag false posts to platforms and partners.

The headline number in this story is $136 billion, but the enduring takeaway is much smaller: one email, one password, one click.

SHARE