A US federal court in the Eastern District of Virginia sentenced Syrian national Ahmed Omar Agha to 42 months in prison on Thursday, October 29, for his role in extensive cyberattacks carried out on behalf of the former Syrian regime.
In a statement published on its official website, the US Department of Justice said Agha, known online as “Th3Pr0,” played a central role in a conspiracy organized and directed by individuals close to ousted Syrian President Bashar al-Assad, including the head of Syrian General Intelligence.
The conspiracy operated from August 24, 2011, to January 31, 2024. Agha had remained a fugitive from justice for more than a decade after targeting Western media outlets, companies and nongovernmental organizations, as well as US and allied government entities.
Spreading Assad Regime Propaganda
According to the US Department of Justice, Agha’s cyberattacks targeted approximately 47 Western and US entities and were intended to spread propaganda for the former Syrian government. Their objectives included:
- Punishing the free press for its coverage of abuses committed by the former regime during the Arab Spring and the subsequent Syrian war.
- Using information warfare tactics to spread fear and confusion among opponents of the former Syrian regime.
- Gathering intelligence.
- Inciting US military personnel to disobey orders and refuse to follow military commands.
- Triggering, in one incident, a brief collapse in US financial markets that temporarily wiped $136 billion from the value of stocks in the Dow Jones Industrial Average.
Assistant Attorney General for National Security John Eisenberg said following the sentencing, according to the department, that Agha had used his hacking skills to serve the Assad regime by silencing media coverage of its crimes, intimidating its opponents and encouraging US military personnel to disobey orders.
He said Agha’s attacks on US networks and institutions, one of which temporarily wiped out $136 billion in American investors’ wealth, constituted a blatant assault on press freedom and US national and economic security.
According to Eisenberg, Agha’s sentence reminds us that US national security authorities have a long memory when it comes to pursuing state-sponsored hackers like Agha.
First Assistant US Attorney for the Eastern District of Virginia Theophani Stamos said the case highlighted the serious threat posed by cybercriminals, particularly those operating on behalf of regimes hostile to the United States.
She added that protecting US cyber infrastructure, financial markets and businesses serving the American public remains a top priority. Authorities would pursue and prosecute anyone who endangered systems supporting national security or destabilized institutions on which Americans depend, she said.
Darren Cox, assistant director in charge of the FBI’s Washington Field Office, said the sentence marked the end of an era of impunity and sent a clear message that anyone targeting US institutions, government agencies and journalists through malicious cyber activities would face justice, regardless of how long they had evaded authorities.
Disinformation, Intimidation and Data Theft
According to the US Department of Justice, Agha carried out hacking operations over several years aimed at spreading disinformation, stealing data, and intimidating victims on behalf of the former Syrian regime.
Court documents showed that Agha’s criminal scheme forced numerous victims to spend substantial sums repairing intrusion damage or restructuring their security systems.
Among the most significant successful attacks were:
- Company G: A company providing content, advertising, and links for websites was targeted in an attack that caused losses of approximately $35,000 per day for nearly six months.
- An international nongovernmental organization: The organization was forced to deploy a new network monitoring system costing approximately $250,000, retrain more than 800 employees, and upgrade its security infrastructure. Its total losses reached $480,000.
- A major news agency’s Twitter account: On April 23, 2013, Agha compromised the account and used it to publish a false report claiming that President Barack Obama had been injured in two explosions at the White House. The false report triggered a sharp but temporary decline of $136 billion in the market value of stocks in the Dow Jones Industrial Average. Agha later boasted about the attack in an interview with Business Insider, saying that causing such a sharp market decline had been the primary objective of the operation and represented a major victory for his group.
- The US Marine Corps recruitment website: Agha gained access to the company hosting the website and redirected visitors to another server displaying an image urging Marines to disobey combat orders and fight alongside the Syrian army. During the attack, approximately 3,500 potential visitors to the recruitment website saw the message instead of the Marine Corps’ promotional and educational materials.
- Attempts to hack the White House: Agha twice attempted to take control of the White House’s social media accounts by stealing usernames and passwords from employees’ email accounts. On one occasion, he successfully gained unauthorized access, which he then used in an unsuccessful attempt to deceive other employees into granting him administrative privileges over the White House’s social media pages.
Agha and his associate, Firas Dardar, were formally indicted on May 17, 2018, following an initial criminal complaint filed against them on June 12, 2014.
Dardar remains a fugitive from justice. He also faces charges in a separate case before the same court, dating to September 29, 2015, involving unauthorized access to and damage to computers, cyber extortion, receiving extortion proceeds, money laundering, wire fraud, violations of sanctions imposed on Syria, and unlawful interstate communications.
The separate case also involved Peter Romar, a Syrian national who had sought residency in Germany. Romar was subsequently extradited from Germany to Virginia and pleaded guilty on September 28, 2016.
The Justice Department said the FBI’s Washington Field Office investigated the case in coordination with the FBI’s Cyber Division. The prosecution was handled by Assistant US Attorney Lauren Weathers and prosecutor Jack Singer-Emery of the National Security Division’s cyber section.
Former Syrian Official Sentenced to 60 Years in Prison
The US Department of Justice announced on September 17 that a former Syrian official who had served as a prison director and governor under the former Syrian regime had been sentenced to 60 years in prison on charges of torture and lying to US immigration officials.
The department said the sentence was handed down to Samir Othman al-Sheikh, 74, who held several positions under the former regime, including director of Damascus Central Prison, commonly known as Adra Prison, governor of Deir Ezzor (eastern Syria) and head of the Political Security branch in Damascus countryside (southwestern Syria).
According to the department, a jury convicted al-Sheikh in March of charges including conspiracy to commit torture, three counts of torture, one count of visa fraud and one count of attempted naturalization fraud.
Evidence presented during the trial showed that al-Sheikh ordered the torture of prisoners and personally participated in it while serving as director of Adra Prison.
The Justice Department said al-Sheikh committed serious human rights violations in Syria, including acts intended to silence political opposition. He also lied about his past to gain entry to the United States in 2020.