The Fake AP Tweet That Erased $136 Billion Finally Got Its Day in Court

A journalist at a newsroom workstation as a red alert glows on a monitor, a conceptual illustration of the risks of compromised news channels

By Dakota Jones

Desk: Crime, Law & Justice, National Security & Defense.

A fake post from the Associated Press’s Twitter account once helped trigger a temporary $136 billion flash crash in the value of stocks making up the Dow Jones Industrial Average. The post appeared on April 23, 2013. The man identified by the Justice Department as central to the hacking conspiracy behind it was sentenced on October 29, 2026.

That gap is the headline inside the headline: more than a decade as a fugitive, followed by a 42-month prison sentence. The case is about much more than one market-shaking lie. Federal prosecutors say the hacking campaign targeted journalists, businesses, NGOs and government entities on behalf of Bashar al-Assad’s regime.

This is a go-to guide to what happened, what the sentence does and does not mean, and why a compromised news account is a national-security problem, not just a bad day on social media.

What happened

A federal district court in the Eastern District of Virginia sentenced Ahmad Umar Agha, 42, a Syrian national also known as Th3Pr0 and Th3 Pr0, to 42 months in prison. According to the Justice Department, he played a central role in a hacking conspiracy organized and led by members of former Syrian President Bashar al-Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate.

The alleged operation ran from as early as August 24, 2011, to January 31, 2024. It targeted approximately 47 Western media entities, businesses, NGOs, and U.S. and allied government entities.

The stated aims, according to DOJ, included spreading regime propaganda, punishing the free press for reporting on atrocities during the Arab Spring and Syrian civil war, intimidating opponents, collecting intelligence, and trying to incite U.S. servicemembers to refuse orders. That is not a casual collection of online pranks. It is information warfare: using digital intrusions to manipulate what people see, frighten opponents and undermine trust.

The most famous attack came on April 23, 2013. Agha hijacked the Associated Press’s Twitter account and posted a false claim that President Barack Obama had been injured after two explosions at the White House. The post triggered a flash crash that temporarily erased $136 billion in value from stocks in the Dow Jones Industrial Average.

The market loss was temporary. The damage to confidence was the point. Agha later bragged to Business Insider that the drop had been “a big victory for us.” A neat summary of the operation’s priorities, if not its ethics.

A conceptual illustration of a market floor responding to a false digital alert, with red and green chart reflections and no real trading data

Other intrusions show the campaign’s reach:

  1. Marine Corps recruitment site: Agha compromised the company hosting the site and redirected about 3,500 visitors to an image urging Marines to refuse orders and fight alongside the Syrian Army.
  2. White House social media: He twice stole credentials for White House staff email accounts in attempts to take over White House social media accounts. He gained access once, but did not take over the accounts.
  3. Business and NGO losses: A company serving online publishers lost about $35,000 a day for roughly six months. A global NGO spent about $250,000 on new network monitoring, retrained more than 800 staff members, and suffered total losses of $480,000.

The image below is included by DOJ in its release as an example of the material shown to visitors redirected from the recruitment website. It is evidence of the hack’s message, not an endorsement of it.

Image published by the Justice Department showing propaganda displayed after visitors were redirected from the U.S. Marine Corps recruitment website

Image: U.S. Department of Justice. DOJ says the image urged Marines to refuse orders and fight alongside the Syrian Army.

Agha and coconspirator Firas Dardar were first charged by complaint on June 12, 2014, and indicted on May 17, 2018. Agha spent more than a decade as a fugitive. Dardar remains a fugitive. In a related 2015 Syrian Electronic Army extortion conspiracy, Peter Romar was extradited from Germany and pleaded guilty on September 28, 2016.

The case was investigated by the FBI Washington Field Office with the FBI Cyber Division. Prosecutors were Assistant U.S. Attorney Laura D. Withers and Trial Attorney Jacques Singer-Emery. The DOJ release, number 26-1289, was dated October 29 and updated October 30, 2026.

Why it matters

You do not need to trade stocks or work in government to have a stake in this case. A trusted news account can become a delivery system for false information if its security fails. When the source is a respected news organization, the lie can travel with borrowed credibility.

That is why the AP attack matters to journalism integrity. The regime’s campaign, as described by prosecutors, targeted journalists for doing journalism: reporting on atrocities. The attempted disruption of a Marines recruitment website and the efforts to reach White House social media accounts show how the same campaign could target public institutions and national security.

Federal officials framed the case in those terms. Assistant Attorney General for National Security John A. Eisenberg said the attacks “constitute an assault on the free press and our national and economic security.” He called the sentence a reminder of the National Security Division’s “long memory in pursuit of state-sponsored hackers.”

FBI Cyber Branch Operations Director Brett Leatherman put it more bluntly: “the FBI never forgets those who target Americans.” First Assistant U.S. Attorney Theophani K. Stamos warned of the grave threat posed by cyber criminals serving hostile regimes.

The timing is striking. Assad’s regime collapsed in December 2024, and he fled the country. The sentencing arrived nearly two years later. The man who helped compromise the AP’s account was still answering for the campaign after its political patron had fallen.

For readers following these issues in Northern Virginia and the wider Washington region, the case also has a local legal connection: it was prosecuted in the Eastern District of Virginia. LD3’s Crime, Law & Justice coverage follows cases where public safety, institutions and accountability intersect.

Verdict

The 2013 fake AP post was arguably among the most consequential false news posts in market history. Its impact was brief, but its reach was enormous. Agha’s own description of the market drop as a “big victory” removes any need to pretend the market effect was an accidental side note.

Still, the sentence deserves careful framing. Forty-two months in prison is the sentence imposed. It does not undo the intrusion, reimburse the victims by itself, or close the case against Dardar, who remains a fugitive. Nor does the passage of time make the original campaign less serious.

The uncomfortable takeaway is simple: trust in journalism is not protected by good intentions alone. It also depends on secure systems, careful verification and accountability when those systems are attacked. The wheels of justice moved slowly here. They did, eventually, reach the courthouse.

Sources