Syrian Hacker Behind $136B Obama Hoax Sentenced to 42 Months
Ahmad Umar Agha, a Syrian Electronic Army hacker, targeted 47 organizations, including AP, the White House, Harvard and Reuters, between 2011 and 2024. His co-conspirator, Firas Dardar, remains a fugitive.
ERBIL (Kurdistan 24) - A US federal court sentenced Ahmad Umar Agha, a Syrian national and member of the pro-Assad Syrian Electronic Army, to 42 months in prison on Wednesday for his role in a decade-long cyberattack campaign conducted on behalf of Bashar al-Assad's former government, including a 2013 hack of the Associated Press's Twitter account that triggered a temporary $136 billion collapse in US stock market value through a fabricated report claiming explosions had occurred at the White House and President Barack Obama had been injured.
The sentencing was handed down by a federal district court in the Eastern District of Virginia.
On April 23, 2013, hackers associated with the Syrian Electronic Army gained unauthorized access to the AP's Twitter account and published a fabricated breaking news message claiming two explosions had occurred at the White House and that President Obama had been injured. The report was entirely false. But before it was identified as fabricated, the message spread through financial markets, triggering automated trading reactions and investor panic. According to the US Department of Justice, the incident caused a temporary $136 billion decline in the value of stocks listed on the Dow Jones Industrial Average. The market recovered after the report was identified as false.
Agha's hacking activities began in August 2011 and according to US prosecutors continued until January 2024. The campaign served multiple purposes: spreading propaganda supporting Assad's government, disrupting Western media organizations reporting on the Syrian conflict, stealing confidential information and intelligence, intimidating opponents of the Assad government, and attempting to influence US military personnel against following orders.
Agha and his associates hacked approximately 47 media organizations, businesses, NGOs, and US and allied government entities. Among the notable incidents, hackers compromised the company hosting the US Marine Corps recruitment website and redirected approximately 3,500 potential visitors to propaganda encouraging Marines to refuse their orders and fight alongside the Syrian Army. Agha twice attempted to gain control of White House social media accounts by stealing email credentials belonging to White House staff, successfully accessing one staff member's email account but failing to take over the official social media accounts. The wider campaign also targeted Harvard University, Reuters, the Washington Post, NPR, and Human Rights Watch.
US prosecutors say the campaign was organized and led by members of Assad's inner circle, including the commander of Syria's General Intelligence Directorate, making the Syrian Electronic Army one of the most documented cases of a state-linked cyber operation targeting Western institutions, financial markets, and press freedom simultaneously.
Agha's alleged co-conspirator Firas Dardar, also known as The Shadow, remains a fugitive. A third Syrian national, Peter Romar, was extradited from Germany and pleaded guilty in 2016.
The case carries three significant dimensions for the current information environment. It demonstrates how a fabricated social media post can trigger major movements in financial markets through automated trading systems. It illustrates how hacking and disinformation were used as tools alongside political and military activities during the Syrian conflict. And it establishes a documented precedent for state-linked cyber operations targeting journalists, governments, and public institutions across more than a decade.