Ahmad Umar Agha
Introduction
Ahmad Umar Agha is a Syrian hacker who was sentenced on October 29, 2026, in the Eastern District of Virginia to 42 months in prison for his central role in an expansive hacking conspiracy organized and led by members of former Syrian President Bashar Al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate. The conspiracy ran from as early as August 24, 2011, to January 31, 2024, and targeted approximately 47 Western media entities, businesses, NGOs, and U.S. and allied government entities. Agha spent a decade as a fugitive after being charged by complaint in 2014 and indicted in 2018.
Background Information
Per the release, Agha hacked on behalf of the former Syrian government to spread its propaganda. The conspiracy penalized the free press for reporting on the regime’s atrocities during the Arab Spring and subsequent Syrian Civil War, used information warfare tactics to cause fear and confusion among Syrian government opponents, collected intelligence for the regime, and attempted to cause mutiny or refusal of duty by members of the U.S. military. Agha and his co-conspirator, Firas Dardar, were initially charged by complaint on June 12, 2014, and indicted on May 17, 2018. Dardar remains a fugitive.
The Controversy or Incident That Led to Their Cancellation
Convicted and sentenced.
The conspiracy’s most consequential strike came on April 23, 2013, when Agha hacked the Twitter account of a widely respected news agency and posted a false claim that President Obama was injured after two explosions at the White House. The post caused a temporary $136 billion flash crash in the value of stocks making up the Dow Jones Industrial Average. Agha later bragged about the attack in an interview with Business Insider, saying that dropping the Dow significantly “was our goal of that hack attack” and that “it was a big victory for us.”
Agha also obtained access to the company hosting the U.S. Marine Corps’ recruitment website and redirected visitors to a server displaying an image encouraging Marines to refuse their orders and fight alongside the Syrian Army; approximately 3,500 potential visitors saw the image instead of U.S. Marines-related recruitment material during the attack. On two occasions, he attempted to obtain control over the White House’s social media page by stealing usernames and passwords for the email accounts of White House staff. In one instance he succeeded, then used the unauthorized access in an unsuccessful effort to trick other White House staff into giving him access to the social media accounts.
The intrusions carried heavy costs for victims. Company G, which provides online publishers with content, website ads, and links to other websites, suffered a loss of approximately $35,000 a day for approximately six months. One global NGO was forced to deploy a new suite of network monitoring products costing around $250,000, retrain over 800 staff members, and upgrade its security system, suffering total losses of $480,000.
The conduct spanned more than twelve years, continuing until January 31, 2024. Dardar was also charged in a separate conspiracy in the Eastern District of Virginia on Sept. 29, 2015 — covering unauthorized access to and damage of computers, extortionate activities, receiving extortion proceeds, money laundering, wire fraud, violations of the Syrian Sanctions Regulations, and unlawful interstate communications — alongside Peter Romar, a Syrian national then residing in Germany. Romar was extradited to the Eastern District of Virginia from Germany and pleaded guilty on Sept. 28, 2016.
Public Reaction and Consequences
“Agha deployed his hacking skills in the service of Assad’s regime to silence reporting on the regime’s atrocities, intimidate its opponents, and incite U.S. servicemembers to refuse their orders,” said Assistant Attorney General for National Security John A. Eisenberg. “His attacks on our networks and institutions, including one that temporarily erased $136 billion from U.S. investors, constitute an assault on the free press and our national and economic security.” Assistant Director in Charge Darren B. Cox of the FBI Washington Field Office said the sentence “sends a clear message that those who target American institutions, journalists, and government entities with malicious cyber activity will be held accountable, no matter how long they attempt to evade justice,” noting Agha “spent a decade as a fugitive.” First Assistant U.S. Attorney Theophani K. Stamos said the case “emphasizes the grave threat posed by cyber criminals and especially those serving regimes hostile to the United States.”
Current Status
Agha was sentenced on October 29, 2026, by a federal district court in the Eastern District of Virginia to 42 months in prison for his central role in the conspiracy, which ran from as early as August 24, 2011, to January 31, 2024. The sentencing followed a long procedural road: complaint on June 12, 2014, indictment on May 17, 2018, and roughly a decade as a fugitive. Co-conspirator Firas Dardar remains a fugitive. The FBI’s Washington Field Office investigated in coordination with the FBI’s Cyber Division, and the case was prosecuted by Assistant U.S. Attorney Laura D. Withers for the Eastern District of Virginia and Trial Attorney Jacques Singer-Emery of the National Security Division’s National Security Cyber Section.
Impact on Their Career/Life
The sentence closes a hacking career that penalized journalists for covering the Assad regime’s atrocities and reached into U.S. financial markets, military recruiting, and the White House’s digital perimeter. The temporary $136 billion flash crash showed how state-sponsored hacking can jolt the American economy, while victims like Company G and the global NGO absorbed remediation costs running from tens of thousands of dollars to $480,000. Agha must now serve 42 months in federal prison, and in the National Security Division’s words, the sentence reflects its “long memory in pursuit of state-sponsored hackers.” Dardar’s continued fugitive status leaves the wider conspiracy only partly resolved.
Sources
- DOJ Office of Public Affairs, “Syrian Man Sentenced for Wide-Ranging Hacking Conspiracy Conducted on Behalf of the Bashar Al Assad Regime”, October 29, 2026 — source