A Syrian man tied to the Syrian Electronic Army (SEA) has received a 42-month prison sentence in the US, more than 12 years after he was first charged. Ahmad Umar Agha, who used the online handle Th3Pr0, was sentenced on Thursday by a federal court in the Eastern District of Virginia. According to the Justice Department, he evaded US authorities for more than a decade. Prosecutors say the hacking conspiracy Agha took part in was directed by figures close to Bashar al-Assad, among them the head of Syria’s General Intelligence Directorate. The scheme began as early as August 2011 and continued until January 2024. The DOJ described Agha as a central figure in the operation. He compromised around 47 targets, a mix of Western news outlets, companies, NGOs, and government bodies in the US and allied countries. Among the intrusions highlighted by prosecutors was the2013 takeoverof the Associated Press’s Twitter account. Agha used it to publish a fabricated report claiming that President Barack Obama had been hurt in two blasts at the White House. The fake post triggered a flash crash that briefly wiped $136 billion off the combined value of the Dow Jones Industrial Average’s component stocks. Agha also gained access to the company hosting theMarine Corps’ recruiting websiteand sent its traffic to an image calling on Marines to defy their orders. He twice went after the White House’s social media presence by targeting the email credentials of White House employees. In one case he obtained them, but his attempt to use that access to dupe other staffers into handing over the accounts did not work. The intrusions left many victims with large bills for cleanup and security overhauls. A firm providing online publishers with content, advertising, and outbound links lost around $35,000 per day for about six months. A global NGO spent roughly $250,000 on new network monitoring tools, retrained more than 800 employees, and upgraded its security, with total losses of $480,000. Agha and his alleged accomplice, Firas Dardar, were firstchargedby criminal complaint in June 2014. The case was unsealed in March 2016, when the FBI put both men on its Cyber’s Most Wanted list and offered a reward of up to $100,000 for information leading to Agha’s arrest. A grand jury indicted the pair in May 2018. Dardar has yet to be caught. Agha’sappearance in a federal courtroomin November 2025 was first reported by legal news outlet Court Watch. The DOJ’s announcement does not explain how or where he was taken into custody. Related:Bulletproof Host Virtualine Loses Its Domain to FBI Seizure Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain Attack Related:Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model BAE Says No Data Extracted in Incident Hitting Bankruptcy Courts Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices Long-Hidden Flaws Patched in EPICS Research Facility Control Software PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak Passkeys Are Better Than Passwords. But They Are Not Enough. Bulletproof Host Virtualine Loses Its Domain to FBI Seizure Fresh WordPress Vulnerability in Attackers’ Crosshairs Drupal Commerce Core Vulnerability Exploited Against Online Stores $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack Max-Severity GitLab Vulnerability Exploited Against Alpine Linux Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program. Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy. Barracuda has appointed Dan Fletcher as CFO. Artemis Security has appointed Arun Singh as CGO. General Paul M. Nakasone has joined Armadin’s Board of Directors. As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George) Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin) The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar) Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley) Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou) FlipboardRedditWhatsappWhatsappEmail