Twelve Words: Assad’s Hacker, a Fake Tweet, and the Ransom the Banks Wouldn’t Wire

A few minutes after one o’clock on the afternoon of April 23, 2013, a message appeared on the Twitter account of the Associated Press, which then had nearly two million followers: there had been two explosions at the White House, and Barack Obama was injured. The message was twelve words long. By the agency’s own later account, the Dow Jones Industrial Average slid from 14,697 to 14,554 in two minutes; ten minutes after the tweet, it had made up every point. A correction went out almost at once, but by then the headline had readers who were not people. Bloomberg terminals had started carrying tweets earlier that year, and some traders put the violence of the drop down to machines.

The Justice Department says that the man behind the message was Ahmad Umar Agha, a hacker for the Syrian Electronic Army who went by the name Th3 Pr0. (If the date of birth on the F.B.I.’s wanted poster is right, he was nineteen at the time.) On October 29th, a federal court in Alexandria, Virginia, sentenced him to forty-two months in prison. According to the department, Agha broke into some forty-seven Western newsrooms, companies, nongovernmental organizations, and government offices, and, with that one post on a hijacked account, briefly took a hundred and thirty-six billion dollars off the value of American stocks. He was first charged in June, 2014. The sentence arrived more than twelve years later, by which time the regime he had served, that of Bashar al-Assad, no longer existed.

The figure deserves a second look. The department assigns the hundred and thirty-six billion dollars to the stocks in the Dow; Reuters, in 2013, put $136.5 billion on the broader S. & P. 500, and the A.P. itself wrote of a hundred and thirty-four billion. None of these numbers measures damage in the legal sense. The value came back within ten minutes, and the only people in a position to lose anything were those who traded in the interval.

The case comes in two layers, and both are better documented than most cyberattacks ever are. The first is set out in an F.B.I. agent’s affidavit from June, 2014: thirty-eight pages on how two young men, one in Damascus and one in Homs, took over the accounts of some of the largest news organizations in the world. The second is in an affidavit from September, 2015: twenty-six pages on how one of them began, on the side, to shake down Web-hosting companies, and why he made almost nothing from it. It helps to remember what these documents are. An affidavit is sworn in order to establish probable cause; it is not a finding by a court. Agha pleaded guilty and has been sentenced; Peter Romar, the go-between in the second case, pleaded guilty in 2016. Firas Dardar, whom the government describes as the principal extortionist, remains at large and is presumed innocent, so everything here that concerns him is the prosecution’s account. Where an assessment or a guess is mine, I say so.

The Sender

In the affidavit, the Syrian Electronic Army, or S.E.A., never breaks a cipher. Its principal method fits in one paragraph: an employee receives an e-mail containing a link; the link leads to a page dressed up as a login screen; the employee types in a username and a password; the form forwards them to the attacker’s in-box. This is phishing, or, when it is aimed at particular people, spear phishing. What made it work was the sender. People at the Washington Post and at Human Rights Watch heard from a mailbox at Qatar’s foreign ministry that the hackers had already taken over. Employees of the A.P. heard from a compromised account at the office of the United Nations High Commissioner for Refugees, which is to say from the organization’s real domain. A single hijacked mailbox at Human Rights Watch was used to send more than six thousand further messages, most of them to the press.

Two details show how closely the hackers read their victims. On April 15, 2013, the day of the Boston Marathon bombing, employees of National Public Radio received, from colleagues whose accounts had already been taken, a link to what looked like an article about the attack. And on May 6th, when the Onion, the satirical news site, sent its employees an 11:48 A.M. instruction to reset their passwords, the hackers, who were already inside one in-box, sent a copy of the message with the link swapped out. At least two more people gave up their passwords in response to a warning about stolen passwords.

The heaviest damage, though, came through suppliers. The Web site of the New York Times vanished without anyone’s breaking into the Times: the hackers got into the systems of Melbourne IT, an Australian domain registrar, two of whose employees, according to the affidavit, entered their passwords after receiving an e-mail that appeared to come from their own chief executive (for a newer edition of the same trick, see “Deepfake C.E.O. Fraud: Inside the $129 Million Indictment”). Traffic bound for CNN, the Post, and Time was rerouted through Outbrain, which supplies publishers with the box of recommended links that sits beneath an article. The Marine Corps’ recruiting site was captured by way of an employee at the advertising agency that managed its domain; for about six hours, some thirty-five hundred visitors, by the government’s count, were shown not a recruiting pitch but an appeal to refuse their orders. Where security did not hang on a single click, the hackers lost. In June, 2012, not one employee at the White House clicked on the link. At NASA, four people did, and a network filter stopped them.

How investigators got from handles to names is told in the affidavit without drama. Twitter’s notice confirming a password reset for the A.P.’s account landed in a private Gmail in-box that Agha used; that same day, one I.P. address was used to log in to the A.P.’s Web mail and, thirty-nine times, to the Gmail account. From that mailbox, which also collected the stolen passwords, someone had sent a scan of an identity document, and its user had e-mailed himself photographs from a wedding. Dardar, the government says, sent the companies he was squeezing a photograph of his bank details, with his own name on the beneficiary line. It is the pattern I described in the case of the Russian group Void Blizzard, many small traces left with many service providers (“An FSB-Linked Hacker Undone by PayPal and One Phone Number. The Void Blizzard Case and Cybersecurity Lessons for Companies”). In an interview with Business Insider that the Justice Department quotes, Agha said that the drop in the Dow had been the purpose of the attack, and “a big victory.”

Know Your Extortionist

According to the 2015 affidavit, Dardar, who called himself the Shadow, began in mid-2013 to turn the same skills, and the S.E.A.’s notoriety, into income. He broke into companies, many of them Web hosts, and then wrote to them as an “ethical hacker” who, for a fee, would describe the hole and help them avoid the next attack. Those who did not answer were given a deadline: an hour, twenty minutes. Those who refused read about the sale of their databases. Investigators counted at least fourteen victims and demands totalling more than half a million dollars; the affidavit describes seven cases in detail.

The most instructive pages in the file set what was demanded beside what was paid. A European hosting company was told to pay three hundred thousand euros; after six months of correspondence, it wired five thousand. A Californian one was supposed to pay a hundred and five thousand euros; it sent about fifteen hundred dollars. A British firm bargained fifty thousand euros down to fifteen thousand and, the correspondence suggests, handed over about sixteen thousand. A Swiss company paid five thousand euros, and a Chinese game company paid small sums. Two American companies paid nothing.

What stopped most of the money was neither the resolve of executives nor the police. It was compliance. A payment system rejected a transfer because the beneficiary’s bank was in Syria. Western Union, in the United States, would not accept an order for Syria. The victims’ banks refused. PayPal, bitcoin, and WebMoney, Dardar told one of the companies, were not available to him in Syria. One American executive wrote back that sending money from the United States to Syria was illegal and impossible, and that Dardar might want to bear this in mind “for future hacks.” Another company, which had already agreed to seventy-five hundred euros, pulled out, citing American sanctions by name.

So Dardar needed someone outside Syria. He found Peter Romar, a Syrian living in Waltershausen, a small town in Thuringia, and from that point the file reads like a manual on document workflow. Before it would wire anything, the European company asked for a signed contract and a copy of the signatory’s passport, and, later, a nondisclosure agreement. Romar supplied both, together with a scan of his own passport. The company’s bank declined to send money to a Syrian national, so the company offered to open an account at another bank. The Swiss firm attached to its transfer a statement that it was paying for “ethical penetration testing received”; the F.B.I. agent’s view is that wording of this kind was meant to lend extortion a veneer of legitimacy. The extortionist had been put through what banks call know-your-customer, and the ransom had acquired the description of a line item.

Romar was arrested in Germany in March, 2016, extradited in May, and, on September 28th, pleaded guilty to two counts of conspiracy. The following month, the docket shows, he was sentenced to time served, two years of supervised release, and $12,888.12 in restitution. His lawyer stressed that Romar had kept nothing for himself and had used his own name throughout. In Poland, a go-between who receives and passes along the proceeds of extortion would face, above all, a money-laundering charge (“Money Laundering under Article 299 of the Polish Criminal Code”) and, depending on his role, a charge of aiding the extortion itself. The affidavit also records an instruction from Dardar to Romar to forward fourteen hundred and fifty euros to a hacker known as Th3 Pr0. Agha was not charged in that case, however, and the announcement of his sentence does not connect him to the extortion.

Forty-Two Months

The 2014 complaint contained a single count of conspiracy, whose objects were violations of eight provisions of federal law, ranging from unauthorized access to computers to a terrorism hoax and an attempt to incite insubordination among the troops. In 2016, the F.B.I. placed both hackers on its list of most-wanted cybercriminals and offered a reward of up to a hundred thousand dollars for each. The indictment, returned in May, 2018, ran to eleven counts: conspiracy (up to five years), conspiracy to commit wire fraud (up to twenty), and counts of aggravated identity theft, which carry a mandatory two years.

The announcement of the sentence leaves out the procedural history, but the court’s docket supplies much of it. Agha pleaded guilty on June 25, 2026, to both conspiracy counts and to six counts of aggravated identity theft; the remaining three were dismissed. The forty-two months consist of eighteen for the conspiracies and the mandatory twenty-four for identity theft, to be followed by three years of supervised release. More than half the sentence, in other words, is the price not of breaking in but of logging in as someone else. According to the docket, the warrant was executed on October 28, 2025, and Agha first appeared in court the next day. How he came into American hands neither the announcement nor the docket says; the Record notes that the department has given no details of the arrest, which Court Watch was the first to report. Whether the court ordered restitution I have not been able to establish. One trap is worth marking. The version of the announcement published by the U.S. Attorney’s office gives the end of the conspiracy as January 31, 2024. That is almost certainly a slip, since the complaint and the department’s own release say January, 2014, but part of the press has already written of a decade of attacks.

What can be said is what the sentence does not contain. It does not contain a hundred and thirty-six billion dollars. The court filings that the department cites record costs that could be attributed and counted: a company that supplies publishers with content and advertising lost about thirty-five thousand dollars a day for roughly six months (simple multiplication puts that above six million), and an international N.G.O. spent four hundred and eighty thousand dollars, a quarter of a million of it on a new network-monitoring system, and retrained more than eight hundred employees. This is how the American computer-crime statute understands loss: as the reasonable cost of responding to an attack, assessing the damage, and restoring the systems, along with revenue lost because service was interrupted.

Then there is the matter of proportion. The go-between, who passed along a few payments worth, all told, something in the low five figures, was sentenced to the few months he had already spent in custody. The hacker who spent two and a half years attacking forty-seven institutions got three and a half years, less credit for the time he has been held. For comparison, the Polish provision on disinformation carried out for a foreign intelligence service, which I will come to, starts at eight.

Students, Then Spymasters

In May, 2011, the S.E.A.’s domain was registered, as the researcher Helmi Noman established, by the Syrian Computer Society, which Bashar al-Assad had headed in the nineteen-nineties. On June 20th of that year, Assad publicly praised the “electronic army.” The group itself insisted that it had no ties to the government. In 2013, a man presented as its leader told the Daily Dot that the authorities were proud of the group but did not know who its members were; a few months later, the hacker who signed himself Th3 Pr0 told Vice that the group had delivered to the government databases taken from the messaging services Viber and Tango and from the caller-I.D. service Truecaller.

The 2014 affidavit describes the S.E.A. as a group acting in support of the regime, and does not claim that anyone in authority directed it; the same is true of the department’s announcements in 2016 and 2018, as the Hacker News has pointed out. The announcement of October 29th says something else: that the conspiracy was organized and led by members of Assad’s inner circle, including the commander of Syria’s General Intelligence Directorate, and that the group gathered intelligence for the government. The department does not explain the change. One may suppose, and it is only a supposition, that two things contributed: the fall of the regime, in December, 2024, and the fact that Agha has been in American custody since 2025.

The practical consequence is an uncomfortable one: the answer to the question of who attacked you is provisional. The victims of 2013 were dealing with a group that presented itself as young volunteers with no ties to the government; thirteen years later, a prosecutor speaks of an intelligence operation. Meanwhile, more and more depends on that answer: the reach of an insurance policy, exposure to sanctions, and, in Polish law, the classification of the crime itself. I went through the consequences of calling an attack a state operation in the Void Blizzard piece; here it is enough to note that attribution can change long after an incident has been closed.

The View from Warsaw

Poland has its own version of this story. On May 31, 2024, the wire of the Polish Press Agency, the national news service, twice carried a false dispatch announcing the partial mobilization of two hundred thousand people; officials spoke of a probable Russian cyberattack. The Warsaw Circuit Prosecutor’s Office opened an investigation under the disinformation provision discussed below; in December, 2024, it was discontinued because the perpetrators could not be identified, and in March, 2025, a court upheld that decision. A hijacked news wire is not an American curiosity.

If the author of such an attack stood before a Polish court, the case would rest on the computer-crime provisions of the criminal code: unauthorized access to a system (Article 267, up to two years), unlawful alteration of data (Article 268a, up to three years, or five where the damage is substantial), disruption of a system (Article 269a), and computer fraud committed in order to cause harm (Article 287), the last two punishable by up to five years. A false report that moves prices is, in addition, market manipulation under Article 12 of the European Union’s Market Abuse Regulation, provided that the person spreading it knew, or ought to have known, that it was false; Poland’s Act on Trading in Financial Instruments provides for a fine of up to five million zlotys, up to five years in prison, or both.

These are penalties counted in single years. One element changes them: acting on behalf of a foreign intelligence service. Since October 1, 2023, Article 130, Section 9, of the code has provided that anyone who, taking part in the activity of a foreign intelligence service or acting on its behalf, conducts disinformation in order to cause serious disruption to the political system or the economy of Poland, of an allied state, or of an international organization to which Poland belongs faces a sentence of no less than eight years. For a false dispatch sent today, then, the decisive question is whether the prosecutor can show a link to an intelligence service: with it, the range is eight to thirty years; without it, what remains are the provisions listed above. In the American announcement, the sentence about the intelligence chief is background. In a Polish indictment, it would be an element of the offense, the one on which the penalty turns, and the hardest thing to prove, as the investigation into the press-agency attack showed.

Jurisdiction is generous in both systems. The 2015 complaint names Loudoun County, Virginia, as the place of the offense, because that is where, in Ashburn, one of the extorted companies kept a server; the defendants were working from Syria and Germany. The Polish code treats an act as committed also where the result that is an element of the offense occurs (Article 6, Section 2), and, under certain conditions, reaches a foreigner’s act abroad against a Polish company (Article 110, Section 1). The evidence, however, sits with service providers: the American investigation was built on records from Google, Microsoft, LinkedIn, Twitter, Facebook, Apple, and Western Union. Such records are not kept forever. A Polish prosecutor can order them preserved for up to ninety days (Article 218a of the Code of Criminal Procedure), and, since August 18th of this year, an E.U. regulation has allowed European production and preservation orders for electronic evidence to be addressed directly to providers in other member states. In practice, none of these instruments is set in motion until the victim reports the crime, and unauthorized access and unlawful alteration of data are prosecuted at all only on the victim’s motion (Article 267, Section 5, and Article 268a, Section 3).

The “ethical hacker” deserves a paragraph of his own. Since 2017, Polish law has protected the researcher who enters someone else’s system solely in order to secure it, promptly notifies its owner, and does no harm (Article 269c). A demand for payment under the threat of selling the data meets none of those conditions. How to classify such blackmail depends on what is threatened. A threat to destroy data raises the question of whether it amounts to the threat of a violent attack on property that extortion under Article 282, Section 1, requires (one to ten years); that is disputed. A threat to disclose is another matter: since October, 2023, Section 2 of the same article has covered, with the same penalty, extortion by the threat of spreading defamatory or seriously privacy-infringing information, or an allegation that could cost someone the trust that his business requires. A threat to sell a customer database, or to announce a breach, may fit, though not every such threat will. Coercion by unlawful threat (Article 191, Section 1, up to three years) and the computer-crime provisions remain in reserve.

In my assessment, simply meeting a blackmailer’s demand is not, in Poland, a crime on the part of the victim. The risk lies nearby. First, sanctions: the comprehensive American program against Syria was lifted in 2025, though Assad and those around him remain listed, and the principle has not changed. The Treasury’s Office of Foreign Assets Control reminds companies that civil penalties for a payment to a sanctioned party do not depend on fault, and the European Union’s Regulation 2019/796 forbids making funds available to anyone listed for cyberattacks. A victim rarely knows who is on the other end; in 2014, not even the prosecutors wrote about it. Second, the duty to report: a nondisclosure agreement signed with a blackmailer does not release a company from its duty to notify the regulator of a personal-data breach (Article 33 of the G.D.P.R.). In 2022, Uber’s former security chief was convicted in the United States of obstruction and of concealing a felony, after a breach was paid off as a bug bounty and wrapped in a nondisclosure agreement. Third, the books: calling a ransom “penetration testing” does not make it a service. I think that such a document fails the reliability requirement of Article 22, Section 1, of Poland’s Accounting Act. As for tax, the Finance Ministry has told the daily Rzeczpospolita that a ransom is not a deductible cost at all, a view that some tax advisers dispute. I am not suggesting that the companies described in the file concealed anything; the documents do not say so.

What Follows

A state’s protection is, for a hacker, an asset with a limited shelf life. An American arrest warrant has no such limit. Writing about Iran’s Mabna Institute, I said that the line between an indictment and a sentence is, in cases of this kind, political rather than legal (“17 Iranians Indicted for $3.4 Billion Academic Hack Targeting 22 Countries, Including Poland”). Here the line moved: the regime fell in December, 2024, and less than a year later its hacker was standing before a judge in Virginia. For victims, the lesson is practical. A report filed today builds a file that can wait.

The number in the headline and the number in the file are two different numbers. A hundred and thirty-six billion dollars vanished and returned in ten minutes; what reached the court were bills for network monitoring and training, and a tally of lost revenue. Damages, insurance, and taxes are settled from documents, so the cost of an incident has to be counted from the first day.

Paying a ransom is a legal decision. In 2013 and 2014, the banks made it for the victims, by refusing to wire money to Syria; no one should count on that kind of accidental shield. Anyone weighing a payment should first establish, as far as it can be established, who is being paid, what must be reported, and how the payment will be described in the books.

The weakest point of some of the world’s great newsrooms turned out to be a domain registrar, an advertising agency, and the supplier of a box of recommended links. Poland’s amended Act on the National Cybersecurity System, in force since April 3rd, requires what it calls essential and important entities to manage risk in their supply chains, and gives them, as a rule, until April 3, 2027, to comply; for everyone else, ordinary prudence asks the same. A contract with a supplier that can repoint someone else’s domain, or publish in someone else’s name, ought to deal with authentication, the reporting of incidents, and liability.

Who the attacker was sometimes becomes clear only years later, and in Polish law it determines what the crime is. In the first days after an attack, then, it is unwise to rest decisions on the assumption that there are only students on the other side.

Firas Dardar has not been arrested or tried. The account of his role comes from the prosecution’s documents, and he is presumed innocent.

Robert Nogacki

Robert Nogacki is a Polish attorney at law (radca prawny), the founder and managing partner of Kancelaria Prawna Skarbiec (Skarbiec Law Firm), which has operated continuously since 2006.

The law is equal for everyone, but the parties rarely are: on one side stands an organization with time, money, and lawyers, on the other a person with one business, one nest egg, and one life.

Clients rarely come to him with a legal problem. They come with a problem that also has a legal side: an audit that began with a single invoice, money entrusted to someone who has disappeared, a company that has to be passed on before it is too late. Most such matters are decided long before the first letter is written, in decisions made without asking and in deadlines nobody remembered. So he begins by asking how the client got here, not what the client should have done.

He advises entrepreneurs and families from more than a dozen countries, including those whose accounts the tax office has just seized and who do not know what to do tomorrow morning. He defends them in tax audits, customs and fiscal inspections, disputes with the tax authorities, and criminal tax proceedings. He represents victims of investment fraud and Ponzi schemes. He helps families set up family foundations and plan succession, so that a life’s work outlasts a single generation.

Not every case can be won. Every case can be run so that the client knows where they stand. Since 2006 he has represented the victims in the WGI case (Warszawska Grupa Inwestycyjna, the Warsaw Investment Group), one of the longest criminal cases in the history of the Polish financial market, because some things must not be left half finished, even when they take two decades. In the case of the collapsed cryptocurrency exchange Zonda (Zondacrypto, operated by BB Trade Estonia OÜ), he represents several hundred victims in the criminal investigation conducted by Poland’s National Prosecutor’s Office and in the Estonian bankruptcy proceedings.

Kancelaria Prawna Skarbiec is listed in the rankings of Poland’s largest tax advisory firms published by Dziennik Gazeta Prawna and Rzeczpospolita, and it is a four-time recipient (2015 to 2018) of the European Medal awarded by the Business Centre Club and the European Economic and Social Committee. Robert Nogacki publishes regularly, in the press and on the firm’s website, for people who have a problem rather than a law degree, because a legal opinion the client cannot understand protects only the lawyer.

He believes that the best legal advice is the kind that means the client never has to appear in court.