Syrian Electronic Army Hacker Gets 42 Months for the Tweet That Wiped $136 Billion Off the Dow
A hacker who helped tank the US stock market with a single fake tweet has finally been sentenced. Ahmad Umar Agha, known online as "Th3Pr0" and a member of the pro-Assad Syrian Electronic Army, received a 42-month federal prison sentence for his role in a wide-ranging hacking conspiracy targeting Western media outlets, government bodies, and businesses.
The Syrian Electronic Army started its campaign in 2011, running fairly straightforward phishing operations: steal employee passwords, deface websites, redirect traffic, hijack social accounts. Unglamorous stuff, but effective.
The group's most spectacular moment came on 23 April 2013, when it seized control of the Associated Press's Twitter account and posted a fake breaking news alert claiming President Obama had been injured in explosions at the White House. The market didn't wait for a correction. The Dow Jones briefly shed around $136 billion in value before it became clear the tweet was nonsense. Agha later told Business Insider that crashing the market was precisely the point. "It was a big victory for us," he said, with no apparent irony.
The Justice Department says the password reset notification for the AP's Twitter account went to a Gmail address used mainly by Agha, placing him directly at the keyboard for that one.
Beyond the headline stunt, Agha racked up roughly 47 victims across Western media, non-profits, and US and allied government organisations. He redirected visitors to the US Marine Corps recruiting website to an image urging Marines to defect and fight for the Syrian Army. Around 3,500 people saw that instead of recruitment information. He also made two attempts to hijack White House social media accounts by targeting staff email credentials, getting into one personal staff account in July 2013 without managing to compromise any official White House systems.
The financial damage to victims was substantial. One content and advertising provider lost around $35,000 a day for roughly six months. A global non-profit burned through $480,000 dealing with the fallout, including a quarter of a million on new network monitoring infrastructure and retraining over 800 staff.
The Justice Department says the conspiracy was organised and directed by figures inside Assad's inner circle, including the commander of Syria's General Intelligence Directorate. That framing is worth a small asterisk: earlier documents in the case, including the original 2014 FBI affidavit and the 2016 charging announcement, described the group as acting "in support of" the Syrian government rather than under its direct command. An early OpenNet Initiative analysis found no hard evidence of direct government control beyond the implicit tolerance any such group would need to operate freely on Syrian networks. Whether the upgraded characterisation reflects new evidence or prosecutorial emphasis is unclear.
Agha was first charged under seal in June 2014, surfaced publicly in March 2016 when the FBI added him to its Cyber's Most Wanted list alongside co-defendant Firas Dardar, and was indicted by a federal grand jury in May 2018. He apparently spent a long time beyond US reach before turning up in federal custody late in 2025.
Dardar remains a fugitive. A third defendant, Peter Romar, was extradited from Germany and pleaded guilty back in 2016.
Assad's government collapsed in December 2024. The organisation that provided cover for this operation no longer exists. Agha's 42-month sentence is about the most concrete consequence anyone involved has faced.