A federal court in the Eastern District of Virginia sentenced Ahmad Umar Agha to 42 months in prison for leading a 2011–2024 hacking conspiracy organized by members of former Syrian President Bashar al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate.
Agha compromised roughly 47 Western media outlets, businesses, NGOs and government entities to spread regime propaganda, intimidate opponents, collect intelligence and, in one case, post a false April 2013 claiming President Obama was injured, triggering a temporary $136 billion flash crash in the Dow Jones Industrial Average.
Prosecutors highlighted substantial remediation costs for victims and framed the sentence as accountability for state- cyber activity that assaulted the free press and U.S. national and economic security.
A federal district court in the Eastern District of Virginia Thursday sentenced Ahmad Umar Agha to 42 months in prison for his central role in an expansive hacking conspiracy organized and led by members of former Syrian President Bashar Al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate, from as early as Aug. 24, 2011, to Jan. 31, 2024.
To spread the former Syrian government’s propaganda, Agha hacked approximately 47 Western media entities, businesses, non-governmental organizations (NGOs), and U.S. and allied government entities. The hacking conspiracy penalized the free press for reporting on the former Syrian government’s atrocities during the Arab Spring and subsequent Syrian Civil War; used information warfare tactics to cause fear and confusion among Syrian government opponents; collected intelligence for the former Syrian government; and attempted to cause mutiny or refusal of duty by members of the military of the United States. In one instance, Agha’s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average.
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg. “His attacks on our networks and institutions, including one that temporarily erased $136 billion from U.S. investors, constitute an assault on the free press and our national and economic security. Today’s sentence should serve as a reminder of the National Security Division’s long memory in pursuit of state- hackers such as Agha.”
“This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia. “The protection of our electronic infrastructure, financial markets, and the companies that serve the American people is of paramount importance. We will pursue and prosecute anyone who endangers the systems that reinforce our national security or undermines the institutions on which our people rely.”
“Today’s sentence sends a clear message that those who target American institutions, journalists, and government entities with malicious cyber activity will be held accountable, no matter how long they attempt to evade justice,” said Assistant Director in Charge Darren B. Cox of the FBI Washington Field Office. “For years, Agha conducted intrusions designed to spread disinformation, steal data, and intimidate victims on behalf of the former Syrian regime, and then spent a decade as a fugitive. The FBI Washington Field Office, together with our partners across the Department of Justice and the FBI, remained steadfast in pursuing this case and ensuring that those who threaten U.S. institutions are brought to justice.”
According to court filings, Agha’s criminal scheme forced many of his victims to spend significant sums of money remediating these intrusions or restructuring their security. Notable examples of Agha’s successful hacks include:
Company G, a company that provides online publishers with content, website ads, and links to other websites, suffered a loss of approximately $35,000 a day for approximately six months.
One global NGO was forced to deploy a new suite of network monitoring products – costing around $250,000 – in addition to retraining over 800 staff members and upgrading its security system. In total, the NGO suffered a total of $480,000 in losses.
Agha’s hack of the Twitter account of a widely respected news agency allowed him to make an April 23, 2013, Twitter post falsely claiming that President Obama was injured after two explosions at the White House. Agha’s actions caused a temporary $136 billion flash crash in the value of stocks making up the Dow. Agha later bragged this hack in an interview with Business Insider, stating that it “was our goal of that hack attack” for the Dow to drop significantly, and “it was a big victory for us.”
Agha obtained access to the company hosting the U.S. Marine Corps’ recruitment website and redirected visitors from that site to a server displaying an image encouraging Marines to refuse their orders and fight alongside the Syrian Army.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
