The US Department of Justice (DOJ) has filed charged against three members of the Syrian Electronic Army (SEA) with involvement in multiple conspiracies related to computer hacking after the hackers allegedly hijacked the websites and social media platforms of prominent US media organizations and the US military.
Ahmad Umar Agha, 22, known online as “The Pro,” and Firas Dardar, 27, known online as “The Shadow,” were charged with a criminal conspiracy relating to: engaging in a hoax regarding a terrorist attack; attempting to cause mutiny of the US armed forces; illicit possession of authentication features; access device fraud; unauthorized access to, and damage of, computers; and unlawful access to stored communications.
Dardar and Peter Romar, 36, also known as Pierre Romar, were separately charged with multiple conspiracies relating to: unauthorized access to, and damage of, computers and related extortionate activities; receiving the proceeds of extortion; money laundering; wire fraud; violations of the Syrian Sanctions Regulations; and unlawful interstate communications.
The criminal charges against the three Syrians were unsealed on Tuesday in the US Eastern District Court of Virginia. The court has issued warrants for all of the defendants.
“These complaints serve to tear down the perceived impunity surrounding their hacking activities and expose the SEA membership’s true colors,” said Assistant Attorney General for National Security John Carlin.
SEA is a group of hackers that supports the regime of Syrian President Bashar al-Assad, according to the Federal Bureau of Investigation (FBI). The group is suspected to be behind multiple cyber attacks against US targets. In 2013, for example, a number of cyber operations were conducted against western targets, many of which were attributed to SEA’s DEADEYE JACKAL, which targets online articles and websites critical of Syria.
According to the FBI, the three SEA hackers charged by DOJ targeted the computer systems of the Executive Office of the President and a US Marine Corps recruitment website in 2013. These websites were considered “antagonistic” toward the Syrian government.
The charges state that Agha and Dardar engaged in a multi-year conspiracy that began in 2011 to collect usernames and passwords that gave them the ability to deface websites, redirect domains to sites controlled by the conspirators, steal e-mail, and hijack social media accounts.
The alleged hackers used an unsophisticated technique known as “spear-phishing” to trick people into providing their login information, which the Syrian nationals then used to access their organizations’ websites and social media accounts.
“These three members of the Syrian Electronic Army targeted and compromised computer systems in order to provide support to the Assad regime as well as for their own personal monetary gain through extortion,” said Washington Field Office Assistant Director in Charge Paul M. Abbate. “As a result of a thorough cyber investigation, FBI agents and analysts identified the perpetrators and now continue to work with our domestic and international partners to ensure these individuals face justice in the United States.”
The FBI has added Agha and Dardar—both believed to be in Syria—to its Cyber’s Most Wanted, and is offering a reward of up to $100,000 each for information that leads to their arrest.
