Those members included the commander of Syria’s General Intelligence Directorate, from as early as Aug. 24, 2011, to Jan. 31, 2014.
Ahmad Umar Agha (also known as Th3Pr0) received 42 months in prison for targeting of Western media entities, businesses, NGOs, and U.S. and allied government entities
To spread the former Syrian government’s propaganda, Agha hacked 47 Western media entities, businesses, non-governmental organizations (NGOs), and U.S. and allied government entities, according to court records.
The hacking conspiracy penalized the free press for reporting on the former Syrian government’s atrocities during the Arab Spring and subsequent Syrian Civil War; used information warfare tactics to cause fear and confusion among Syrian government opponents; collected intelligence for the former Syrian government; and attempted to cause mutiny or refusal of duty by members of the military of the United States.
Stocks Lose $136 Billion
In one instance, Agha’s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average.
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg. “His attacks on our networks and institutions, including one that temporarily erased $136 billion from U.S. investors, constitute an assault on the free press and our national and economic security.”
“This case emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States,” said First Assistant U.S. Attorney Theophani K. Stamos for the Eastern District of Virginia. “The protection of our electronic infrastructure, financial markets, and the companies that serve the American people is of paramount importance.”
“Ahmad Umar Agha carried out a hacking campaign against Western news media simply for reporting on the atrocities of the Bashar al-Assad regime,” said Operations Director Brett Leatherman of the FBI’s Cyber Branch. “He also targeted businesses, NGOs, government agencies, and other perceived enemies of the former Syrian government. After spending more than a decade as a fugitive, Agha ended up sentenced today to federal prison.”
Successful Hacks
- Agha’s scheme forced his victims to spend significant sums of money remediating these intrusions or restructuring their security, according to court records. Notable examples of Agha’s successful hacks include:
- Company G, a company that provides online publishers with content, website ads, and links to other websites, suffered a loss of approximately $35,000 a day for approximately six months.
- One global NGO deployed a new suite of network monitoring products – costing around $250,000 – in addition to retraining over 800 staff members and upgrading its security system. In total, the NGO suffered a total of $480,000 in losses.
- Agha’s hack of the Twitter account of a widely respected news agency allowed him to make an April 23, 2013, Twitter post falsely claiming President Obama ended up injured after two explosions at the White House. Moreover, Agha’s actions caused a temporary $136 billion flash crash in the value of stocks making up the Dow. Agha later bragged about this hack in an interview with Business Insider, stating that it “was our goal of that hack attack” for the Dow to drop significantly, and “it was a big victory for us.”
- Agha obtained access to the company hosting the U.S. Marine Corps’ recruitment website and redirected visitors from that site to a server displaying an image encouraging Marines to refuse their orders and fight alongside the Syrian Army.
- On two occasions, Agha attempted to obtain control over the White House’s social media page by stealing usernames and passwords for the email accounts of White House staff. In one instance, Agha succeeded and used his unauthorized access in an unsuccessful effort to trick other White House Staff into giving him access to the White House’s social media accounts.
Others Charged
Agha and his coconspirator, Firas Dardar, ended up indicted on May 17, 2018, after initially being charged by complaint on June 12, 2014.
Dardar remains a fugitive. Dardar also ended up charged in a separate conspiracy in the Eastern District of Virginia on Sept. 29, 2015, relating to unauthorized access to, and damage of, computers and related extortionate activities; receiving the proceeds of extortion; money laundering; wire fraud; violations of the Syrian Sanctions Regulations; and unlawful interstate communications, alongside Peter Romar, a Syrian national then residing in Germany.
Romar ended up extradited to the Eastern District of Virginia from Germany and pleaded guilty on Sept. 28, 2016.