Overview
- A federal judge handed Ahmad Umar Agha a 42-month prison term on Thursday, October 29, 2026, following a Justice Department prosecution that tied him to a long-running hacking campaign directed by figures close to Bashar al-Assad.
- Prosecutors said the campaign used phishing, stolen credentials, account takeovers and website redirects to spread disinformation and collect intelligence for the Syrian regime.
- The most damaging incidents included a hijacked news-agency social post on April 23, 2013, that briefly erased an estimated $136 billion in Dow component value and a September 2013 compromise of the company hosting the U.S. Marine Corps recruiting site that redirected about 3,500 visitors to propaganda.
- Court filings say Agha worked from at least August 2011 through January 31, 2024, breached roughly 47 media outlets, companies, NGOs and government entities, forced victims to spend large sums on cleanup and upgrades, and that one content company lost about $35,000 per day while a global NGO incurred roughly $480,000 in total losses.
- The case closes a long legal arc—initial complaint in 2014, indictment in 2018, a 2025 court appearance after more than a decade on the run—but a co-defendant, Firas Dardar, remains at large and the sentence underlines U.S. efforts to deter state-linked cyber operations and push organizations to strengthen defenses.