NEWS

Syrian Electronic Army Hacker Behind Fake AP Tweet Gets 42 Months in Prison

Ahmad Umar Agha, aka Th3Pr0, was sentenced to 42 months for hacking Western media outlets, including the 2013 AP tweet that briefly cut $136B from the Dow.

Dylan H.

News Desk

October 30, 2026
2 min read
Syrian Electronic Army Hacker Behind Fake AP Tweet Gets 42 Months in Prison

Summary

A U.S. federal court has sentenced Ahmad Umar Agha, a Syrian Electronic Army (SEA) hacker known as "Th3Pr0", to 42 months in prison. The Justice Department announced the sentence on October 29, 2026.

Background

  • On April 23, 2013, the SEA hijacked the Associated Press's Twitter account and posted a false report that President Obama had been injured in explosions at the White House. The Justice Department says Agha carried out the hack, which caused a temporary $136 billion drop in the Dow Jones Industrial Average. Agha later told Business Insider the drop "was our goal of that hack attack."
  • An FBI affidavit said Twitter's password reset confirmation for the account went to a Gmail account used mainly by Agha.
  • The DOJ says Agha hacked about 47 Western media outlets, businesses, non-profits and government bodies, including a redirect affecting visitors to the U.S. Marine Corps recruiting website's host (about 3,500 potential visitors).
  • A June 2014 complaint was sealed until March 2016, when the FBI added Agha and co-defendant Firas Dardar to its Cyber's Most Wanted list with a $100,000 reward. A grand jury indicted both in 2018. Agha was in U.S. custody by late 2025; Dardar remains a fugitive. Peter Romar, charged separately, was extradited and pleaded guilty in 2016.

Attribution Caveat

The DOJ says the conspiracy was organized and led by members of Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate. The Hacker News notes that the 2014 affidavit and the 2016 and 2018 announcements did not describe Syrian officials organizing or leading the group; the 2016 release said only that it acted "in support of" the government.

Why It Matters

The case is a reminder that a single compromised social media account can move markets, and that account recovery paths (such as a personal email receiving reset links) remain a favored target. Law enforcement timelines for cases like this can stretch over a decade.

Recommendations

  1. Enforce phishing-resistant MFA on corporate social media and media-CMS accounts.
  2. Lock down password recovery email and phone numbers; use shared, monitored role addresses.
  3. Limit who can post on high-reach accounts and require approval workflows.
  4. Prepare a rapid public-correction playbook for account hijacks.

Sources