Syrian Electronic Army Hacker Ahmad Umar Agha Sentenced to 42 Months
Summary
Ahmad Umar Agha, known as Th3Pr0, was sentenced to 42 months for his role in a Syrian Electronic Army hacking conspiracy. DOJ tied him to the 2013 AP tweet hack and said the campaign targeted about 47 organizations; earlier records differ on Syrian officials’ role.
Key points
- The Justice Department said Agha carried out the 2013 hijacking of the Associated Press’s Twitter account and the false tweet about explosions at the White House; it said the post temporarily reduced Dow Jones stock values by $136 billion.
- According to a 2014 FBI affidavit, Syrian Electronic Army members used phishing emails to steal employee passwords, then defaced websites, redirected web traffic, and hijacked social media accounts.
- The Justice Department said the conspiracy targeted about 47 Western media outlets, businesses, nonprofit groups, and U.S. and allied government bodies.
- Agha redirected visitors to a U.S. Marine Corps recruiting website to an image urging Marines to refuse orders; about 3,500 potential visitors saw it, the department said.
- Court filings cited by the department describe significant victim costs, including one nonprofit’s $480,000 in losses and expenses and another company’s reported $35,000-per-day losses for about six months.
- The Justice Department said members of Assad’s inner circle organized and led the conspiracy, but the article notes earlier public case documents did not make that claim and an OpenNet Initiative study found no credible direct link between the attackers and the Syrian government.
- Co-defendant Firas Dardar remains a fugitive, according to the Justice Department.
Article Details
- Event Type
- Sentencing in a cybercrime case involving a hacking conspiracy targeting Western news outlets and other organizations.
- Impact
- Ahmad Umar Agha was sentenced to 42 months in prison. The Justice Department attributed a temporary $136 billion drop in Dow Jones Industrial Average stock value to the group's hijacking of the Associated Press's Twitter account. The department said Agha hacked about 47 media outlets, businesses, nonprofit groups, and U.S. and allied government bodies. Victims reportedly incurred cleanup and security costs; cited losses included about $35,000 per day for six months at one company and $480,000 at a global nonprofit.
MITRE ATT&CK
T1078 · Valid AccountsThe group used stolen passwords to access accounts, deface websites, redirect web traffic, and hijack social media accounts.T1491.002 · External DefacementThe group defaced websites; Agha also redirected visitors to a U.S. Marine Corps recruiting website to an image urging Marines to refuse their orders.T1566 · PhishingThe Syrian Electronic Army sent phishing emails to steal employees' passwords, according to a 2014 FBI affidavit.
People
Threat Actors
Ahmad Umar AghaThe Justice Department said Agha carried out the 2013 Associated Press account hack and other intrusions; he was sentenced to 42 months in prison for his role in the hacking conspiracy. The article says he was known online as Th3Pr0.Firas DardarCo-defendant indicted with Agha in 2018 in the hacking conspiracy; the Justice Department said Dardar remains a fugitive.Syrian Electronic ArmyThe pro-Assad group began attacks in 2011 and used phishing to steal passwords, then defaced websites, redirected traffic, and hijacked social media accounts, according to a 2014 FBI affidavit.Th3Pr0Online name used by Ahmad Umar Agha, whom the Justice Department said carried out the Associated Press account hack; Agha was sentenced for his role in the hacking conspiracy.
Products
GmailTwitter's message confirming a password reset for that account was sent to a Gmail account used primarily by Agha, the affidavit says.TwitterOn April 23, 2013, the group hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in two explosions at the White House.
Countries
Syriaand led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, the U.S. Justice Department said on October 29.United StatesAhmad Umar Agha, a Syrian Electronic Army hacker known online as "Th3Pr0," has been sentenced by a U.S. federal court to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets.
Industries
GovernmentIn the 2016 announcement, the department said the group acted "in support of" the Syrian government.Mediapasswords, then used those passwords to deface websites, redirect web traffic, and hijack social media accounts, according to a 2014 FBI affidavit.Non-profitIn all, Agha hacked about 47 Western media outlets, businesses, non-profit groups, and U.S. and allied government bodies, the department said.