Syrian Hacker Behind Fake Tweet That Triggered $136 Billion Market Drop Gets 42 Months in Prison

The Syrian hacker, Ahmad Umar Agha, operated under the online alias "Th3Pr0" and was part of the pro-Assad Syrian Electronic Army. The U.S. federal court sentenced him on October 29, 2026, for his role in a hacking conspiracy that targeted Western news outlets and government institutions. The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate.

The Syrian Electronic Army began its attacks in 2011, using phishing emails to steal employees' passwords. They then used these credentials to deface websites, redirect web traffic, and hijack social media accounts. Their most significant attack occurred on April 23, 2013, when they hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in explosions at the White House.

Market Impact

The fake tweet caused a temporary $136 billion drop in the value of stocks in the Dow Jones Industrial Average. Twitter's message confirming a password reset for the AP account was sent to a Gmail account primarily used by Agha. Agha later admitted that causing a big drop in the Dow "was our goal of that hack attack."

The Justice Department revealed that Agha hacked approximately 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies. He gained access to the company hosting the U.S. Marine Corps recruiting website and redirected visitors to an image urging Marines to refuse orders and fight alongside the Syrian Army. About 3,500 potential recruits saw this image instead of recruiting material.

Broader Conspiracy

Agha also attempted to take over the White House's social media accounts by stealing staff email passwords. While he successfully accessed a staff member's personal email account in July 2013, no official White House account was compromised. The conspiracy collected intelligence for Assad's government, which fell in December 2024.

Many victims suffered significant financial losses due to the attacks. One company supplying online publishers with content, ads, and links lost about $35,000 daily for six months. A global non-profit group lost $480,000, including $250,000 on new network monitoring tools, and had to retrain more than 800 staff members.

Agha was first charged in June 2014 and added to the FBI's Cyber's Most Wanted list in March 2016 with a $100,000 reward. His co-defendant Firas Dardar remains a fugitive. Peter Romar, another Syrian national involved in a separate case, was extradited to the U.S. and pleaded guilty in 2016.