Syrian Electronic Army hacker Agha sentenced 42 months for 2013 AP Twitter compromise that erased $136B Dow value

Agha conducted the compromise via phishing for AP staff credentials, with the password-reset confirmation routed to his primary Gmail account. Court records document 47 total intrusions against media, nonprofits, and U.S. government entities, including redirection of the Marine Corps recruiting site viewed by 3,500 visitors and two failed attempts against White House social accounts. One victim publisher reported $35,000 daily losses for six months; a global nonprofit spent $480,000 on remediation and retraining 800 staff. The 2014 FBI affidavit and 2016 DOJ filings described SEA activity only as conducted in support of the Assad government, yet the October 2025 sentencing announcement claimed direct organization by General Intelligence Directorate leadership. An OpenNet Initiative study from the period found no technical evidence of state infrastructure control beyond routine Syrian network access. The discrepancy appears after the regime's December 2024 collapse.