Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms – Krebs on Safety

U.S. prosecutors final week levied legal hacking expenses towards 19-year-old U.Okay. nationwide Thalha Jubair for allegedly being a core member of Scattered Spider, a prolific cybercrime group blamed for extorting a minimum of $115 million in ransom funds from victims. The costs got here as Jubair and an alleged co-conspirator appeared in a London courtroom to face accusations of hacking into and extorting a number of massive U.Okay. retailers, the London transit system, and healthcare suppliers in the USA.

At a courtroom listening to final week, U.Okay. prosecutors laid out a litany of expenses towards Jubair and 18-year-old Owen Flowers, accusing the kids of involvement in an August 2024 cyberattack that crippled Transport for London, the entity accountable for the general public transport community within the Larger London space.

A courtroom artist sketch of Owen Flowers (left) and Thalha Jubair showing at Westminster Magistrates’ Courtroom final week. Credit score: Elizabeth Cook dinner, PA Wire.

On July 10, 2025, KrebsOnSecurity reported that Flowers and Jubair had been arrested in the UK in reference to current Scattered Spider ransom attacks towards the retailers Marks & Spencer and Harrods, and the British meals retailer Co-op Group.

That story cited sources near the investigation saying Flowers was the Scattered Spider member who anonymously gave interviews to the media within the days after the group’s September 2023 ransomware assaults disrupted operations at Las Vegas casinos operated by MGM Resorts and Caesars Leisure.

The story additionally famous that Jubair’s alleged handles on cybercrime-focused Telegram channels had far lengthier rap sheets involving a few of the extra consequential and headline-grabbing knowledge breaches over the previous 4 years. What follows is an account of cybercrime actions that prosecutors have attributed to Jubair’s alleged hacker handles, as instructed by these accounts in posts to public Telegram channels which might be carefully monitored by a number of cyber intelligence corporations.

EARLY DAYS (2021-2022)

Jubair is alleged to have been a core member of the LAPSUS$ cybercrime group that broke into dozens of technology companies beginning in late 2021, stealing supply code and different inner knowledge from tech giants together with Microsoft, Nvidia, Okta, Rockstar Video games, Samsung, T-Cell, and Uber.

That’s, in line with the previous chief of the now-defunct LAPSUS$. In April 2022, KrebsOnSecurity published internal chat records taken from a server that LAPSUS$ used, and people chats point out Jubair was working with the group utilizing the nicknames Amtrak and Asyntax. In the midst of the gang’s cybercrime spree, Asyntax instructed the LAPSUS$ chief to not share T-Cell’s brand in pictures despatched to the group as a result of he’d been beforehand busted for SIM-swapping and his dad and mom would suspect he was again at it once more.

The chief of LAPSUS$ responded by gleefully posting Asyntax’s actual title, cellphone quantity, and different hacker handles right into a public chat room on Telegram:

In March 2022, the chief of the LAPSUS$ knowledge extortion group uncovered Thalha Jubair’s title and hacker handles in a public chat room on Telegram.

That story concerning the leaked LAPSUS$ chats additionally related Amtrak/Asyntax to a number of earlier hacker identities, together with “Everlynn,” who in April 2021 started providing a cybercriminal service that sold fraudulent “emergency data requests” concentrating on the foremost social media and e mail suppliers.

In these so-called “pretend EDR” schemes, the hackers compromise e mail accounts tied to police departments and authorities businesses, after which ship unauthorized calls for for subscriber knowledge (e.g. username, IP/e mail deal with), whereas claiming the knowledge being requested can’t look ahead to a courtroom order as a result of it pertains to an pressing matter of life and demise.

The roster of the now-defunct “Infinity Recursion” hacking group, which offered pretend EDRs between 2021 and 2022. The founder “Everlynn” has been tied to Jubair. The member listed as “Peter” grew to become the chief of LAPSUS$ who would later publish Jubair’s title, cellphone quantity and hacker handles into LAPSUS$’s chat channel.

EARTHTOSTAR

Prosecutors in New Jersey final week alleged Jubair was a part of a risk group variously referred to as Scattered Spider, 0ktapus, and UNC3944, and that he used the nicknames EarthtoStar, Brad, Austin, and Austistic.

Starting in 2022, EarthtoStar co-ran a bustling Telegram channel referred to as Star Chat, which was house to a prolific SIM-swapping group that relentlessly used voice- and SMS-based phishing assaults to steal credentials from staff on the main wi-fi suppliers within the U.S. and U.Okay.

Jubair allegedly used the deal with “Earth2Star,” a core member of a prolific SIM-swapping group working in 2022. This advert produced by the group lists varied costs for SIM swaps.

The group would then use that entry to promote a SIM-swapping service that would redirect a goal’s cellphone quantity to a tool the attackers managed, permitting them to intercept the sufferer’s cellphone calls and textual content messages (together with one-time codes). Members of Star Chat focused a number of wi-fi carriers with SIM-swapping assaults, however they centered primarily on phishing T-Cell staff.

In February 2023, KrebsOnSecurity scrutinized greater than seven months of those SIM-swapping solicitations on Star Chat, which just about each day peppered the general public channel with “Tmo up!” and “Tmo down!” notices indicating durations whereby the group claimed to have energetic entry to T-Cell’s community.

A redacted receipt from Star Chat’s SIM-swapping service concentrating on a T-Cell buyer after the group gained entry to inner T-Cell worker instruments.

The information confirmed that Star Chat — together with two different SIM-swapping teams working on the similar time — collectively broke into T-Mobile over a hundred times in the last seven months of 2022. Nonetheless, Star Chat was by far essentially the most prolific of the three, accountable for a minimum of 70 of these incidents.

The 104 days within the latter half of 2022 by which completely different identified SIM-swapping teams claimed entry to T-Cell worker instruments. Star Chat was accountable for a majority of those incidents. Picture: krebsonsecurity.com.

A overview of EarthtoStar’s messages on Star Chat as listed by the risk intelligence agency Flashpoint exhibits this particular person additionally offered “AT&T e mail resets” and AT&T name forwarding providers for as much as $1,200 per line. EarthtoStar defined the aim of this service in publish on Telegram:

“Okay persons are confused, so you already know when u login to chase and it says ‘2fa required’ or regardless of the fuck, properly it provides you two choices, SMS or Name. In case you press name, and I ahead the road to you then who do you assume will get mentioned name?”

New Jersey prosecutors allege Jubair additionally was concerned in a mass SMS phishing campaign during the summer of 2022 that stole single sign-on credentials from staff at lots of of firms. The textual content messages requested customers to click on a hyperlink and log in at a phishing web page that mimicked their employer’s Okta authentication web page, saying recipients wanted to overview pending adjustments to their upcoming work schedules.

The phishing web sites used a Telegram instantaneous message bot to ahead any submitted credentials in real-time, permitting the attackers to make use of the phished username, password and one-time code to log in as that worker at the actual employer web site.

That weeks-long SMS phishing marketing campaign led to intrusions and knowledge thefts at greater than 130 organizations, together with LastPass, DoorDash, Mailchimp, Plex and Sign.

A visible depiction of the assaults by the SMS phishing group referred to as 0ktapus, ScatterSwine, and Scattered Spider. Picture: Amitai Cohen twitter.com/amitaico.

DA, COMRADE

EarthtoStar’s group Star Chat specialised in phishing their means into enterprise course of outsourcing (BPO) firms that present buyer help for a spread of multinational firms, together with a lot of the world’s largest telecommunications suppliers. In Could 2022, EarthtoStar posted to the Telegram channel “Frauwudchat”:

“Hello, I’m on the lookout for companions as a way to exfiltrate knowledge from massive telecommunications firms/name facilities/alike, I’ve main expertise on this area, [including] a large name middle which homes 200,000+ staff the place I’ve dumped all consumer credentials and gained entry to the [domain controller] + obtained international administrator I even have expertise with REST API’s and programming. I’ve intensive expertise with VPN, Citrix, cisco anyconnect, social engineering + privilege escalation. In case you have any Citrix/Cisco VPN or another helpful issues please message me and lets work.”

At across the similar time within the Summer time of 2022, a minimum of two completely different accounts tied to Star Chat — “RocketAce” and “Lopiu” — launched the group’s providers to denizens of the Russian-language cybercrime discussion board Exploit, together with:

-SIM-swapping providers concentrating on Verizon and T-Cell prospects;
-Dynamic phishing pages concentrating on prospects of single sign-on suppliers like Okta;
-Malware improvement providers;
-The sale of prolonged validation (EV) code signing certificates.

The consumer “Lopiu” on the Russian cybercrime discussion board Exploit marketed most of the similar distinctive providers provided by EarthtoStar and different Star Chat members. Picture supply: ke-la.com.

These two accounts on Exploit created a number of gross sales threads by which they claimed administrative entry to U.S. telecommunications suppliers and requested different Exploit members for assist in monetizing that entry. In June 2022, RocketAce, which seems to have been simply one among EarthtoStar’s many aliases, posted to Exploit:

Hey. I’ve entry to a telecommunications firm’s citrix and vpn. I would love somebody to assist me get away of the system and doubtlessly assault the area controller so all logins may be extracted we will talk about cost and issues depart your telegram within the feedback or personal message me ! On the lookout for somebody with data in citrix/privilege escalation

On Nov. 15, 2022, EarthtoStar posted to their Star Sanctuary Telegram channel that they have been hiring malware builders with a minimal of three years of expertise and the flexibility to develop rootkits, backdoors and malware loaders.

“Optionally available: Endorsed by superior APT Teams (e.g. Conti, Ryuk),” the advert concluded, referencing two of Russia’s most rapacious and damaging ransomware affiliate operations. “A part of a nation-state / ex-3l (3 letter-agency).”

2023-PRESENT DAY

The Telegram and Discord chat channels whereby Flowers and Jubair allegedly deliberate and executed their extortion assaults are a part of a loose-knit community referred to as the Com, an English-speaking cybercrime group consisting largely of people residing in the USA, the UK, Canada and Australia.

Many of those Com chat servers have lots of to hundreds of members every, and a few of the extra fascinating solicitations on these communities are job provides for in-person assignments and duties that may be discovered if one searches for posts titled, “In case you stay close to,” or “IRL job” — brief for “in actual life” job.

These “violence-as-a-service” solicitations usually contain “brickings,” the place somebody is employed to toss a brick by way of the window at a specified deal with. Different IRL jobs for rent embrace tire-stabbings, molotov cocktail hurlings, drive-by shootings, and even house invasions. The individuals focused by these providers are usually different criminals throughout the group, however it’s common to see Com members asking others for assist in harassing or intimidating safety researchers and even the very regulation enforcement officers who’re investigating their alleged crimes.

It stays unclear what precipitated this incident or what adopted immediately after, however on January 13, 2023, a Star Sanctuary account utilized by EarthtoStar solicited the house invasion of a sitting U.S. federal prosecutor from New York. That publish included a photograph of the prosecutor taken from the Justice Division’s web site, together with the message:

“Want irl niggas, in house hostage shit no fucking pussies no skinny glock holding 100 pound niggas both”

All through late 2022 and early 2023, EarthtoStar’s alias “Brad” (a.okay.a. “Brad_banned”) ceaselessly marketed Star Chat’s malware improvement providers, together with customized malicious software program designed to cover the attacker’s presence on a sufferer machine:

We are able to develop KERNEL malware which can obtain persistence for a very long time,
bypass firewalls and have reverse shell entry.

This shit is actually like STAGE 4 CANCER FOR COMPUTERS!!!

Kernel that means the best degree of authority on a machine.
This will vary to easy shells to Bootkits.

Bypass all main EDR’s (SentinelOne, CrowdStrike, and so on)
Patch EDR’s scanning performance so it’s rendered ineffective!

As soon as implanted, extraordinarily troublesome to take away (mainly unattainable to even discover)
Growth Expertise of a number of years and in a number of APT Teams.

Be one step forward of the sport. Costs begin from $5,000+. Message @brad_banned to get a quote

In September 2023 , each MGM Resorts and Caesars Leisure suffered ransomware assaults by the hands of a Russian ransomware associates program referred to as ALPHV and BlackCat. Caesars reportedly paid a $15 million ransom in that incident.

Inside hours of MGM publicly acknowledging the 2023 breach, members of Scattered Spider have been claiming credit score and telling reporters they’d damaged in by social engineering a third-party IT vendor. At a listening to in London final week, U.Okay. prosecutors instructed the courtroom Jubair was present in possession of greater than $50 million in ill-gotten cryptocurrency, together with funds that have been linked to the Las Vegas on line casino hacks.

The Star Chat channel was lastly banned by Telegram on March 9, 2025. However U.S. prosecutors say Jubair and fellow Scattered Spider members continued their hacking, phishing and extortion actions up till September 2025.

In April 2025, the Com was buzzing concerning the publication of “The Com Solid,” a prolonged screed detailing Jubair’s alleged cybercriminal actions and nicknames through the years. This account included pictures and voice recordings allegedly of Jubair, and asserted that in his early days on the Com Jubair used the nicknames Clark and Miku (these are each aliases utilized by Everlynn in reference to their pretend EDR providers).

Thalha Jubair (proper), with out his large-rimmed glasses, in an undated picture posted in The Com Solid.

Extra not too long ago, the nameless Com Solid creator(s) claimed, Jubair had used the nickname “Operator,” which corresponds to a Com member who ran an automatic Telegram-based doxing service that pulled client data from hacked knowledge dealer accounts. That public outing got here after Operator allegedly seized management over the Doxbin, a long-running and extremely poisonous group that’s used to “dox” or publish deeply private info on individuals.

“Operator/Clark/Miku: A key member of the ransomware group Scattered Spider, which consists of a various combine of people concerned in SIM swapping and phishing,” the Com Solid account acknowledged. “The group is an amalgamation of a number of key organizations, together with Infinity Recursion (owned by Operator), True Alcorians (owned by earth2star), and Lapsus, which have come collectively to kind a single collective.”

The New Jersey complaint (PDF) alleges Jubair and different Scattered Spider members dedicated pc fraud, wire fraud, and cash laundering in relation to a minimum of 120 pc community intrusions involving 47 U.S. entities between Could 2022 and September 2025. The criticism alleges the group’s victims paid a minimum of $115 million in ransom funds.

U.S. authorities say they traced a few of these funds to Scattered Spider to an Web server managed by Jubair. The criticism states {that a} cryptocurrency pockets found on that server was used to buy a number of reward playing cards, one among which was used at a meals supply firm to ship meals to his condo. One other reward card bought with cryptocurrency from the identical server was allegedly used to fund on-line gaming accounts below Jubair’s title. U.S. prosecutors mentioned that after they seized that server additionally they seized $36 million in cryptocurrency.

The criticism additionally expenses Jubair with involvement in a hacking incident in January 2025 towards the U.S. courts system that focused a U.S. Justice of the Peace choose overseeing a associated Scattered Spider investigation. That different investigation seems to have been the prosecution of Noah Michael City, a 20-year-old Florida man charged in November 2024 by prosecutors in Los Angeles as one among 5 alleged Scattered Spider members.

City pleaded responsible in April 2025 to wire fraud and conspiracy expenses, and in August he was sentenced to 10 years in federal jail. Talking with KrebsOnSecurity from jail after his sentencing, City asserted that the choose gave him extra time than prosecutors requested as a result of he was mad that Scattered Spider hacked his email account.

Noah “Kingbob” City, posting to Twitter/X across the time of his sentencing on Aug. 20.

A court transcript (PDF) from a standing listening to in February 2025 exhibits City was telling the reality concerning the hacking incident that occurred whereas he was in federal custody. The choose instructed attorneys for either side {that a} co-defendant within the California case was looking for out about Mr. City’s exercise within the Florida case, and that the hacker accessed the account by impersonating a choose over the cellphone and requesting a password reset.

Allison Nixon is chief analysis officer on the New York based mostly safety agency Unit 221B, and simply one of many world’s main consultants on Com-based cybercrime exercise. Nixon mentioned the core downside with legally prosecuting well-known cybercriminals from the Com has historically been that the highest offenders are typically below the age of 18, and thus troublesome to cost below federal hacking statutes.

In the USA, prosecutors usually wait till an underage cybercrime suspect turns into an grownup to cost them. However till that day comes, she mentioned, Com actors usually really feel emboldened to proceed committing — and fairly often bragging about — critical cybercrime offenses.

“Right here we have now a particular class of Com offenders that successfully take pleasure in authorized immunity,” Nixon instructed KrebsOnSecurity. “Most get recruited to Com teams when they’re older, however of those who be a part of very younger, resembling 12 or 13, they appear to be essentially the most harmful as a result of at that age they haven’t any grounding in actuality and a lot longevity earlier than they exit their authorized immunity.”

Nixon mentioned U.Okay. authorities face the identical problem after they briefly detain and search the houses of underage Com suspects: Specifically, the teenager suspects merely go proper again to their respective cliques within the Com and begin robbing and hurting individuals once more the minute they’re launched.

Certainly, the U.Okay. courtroom heard from prosecutors final week that each Scattered Spider suspects have been detained and/or searched by native regulation enforcement on a number of events, solely to return to the Com lower than 24 hours after being launched every time.

“What we see is these younger Com members grow to be vectors for perpetrators to commit enormously dangerous acts and even baby abuse,” Nixon mentioned. “The members of this particular class of people that take pleasure in authorized immunity are assembly up with international nationals and conducting these generally heinous acts at their behest.”

Nixon mentioned many of those people have few buddies in actual life as a result of they spend nearly all of their waking hours on Com channels, and so their whole sense of id, group and self-worth will get wrapped up of their involvement with these on-line gangs. She mentioned if the regulation was such that prosecutors might deal with these individuals commensurate with the quantity of hurt they trigger society, that may in all probability clear up numerous this downside.

“If regulation enforcement was allowed to maintain them in jail, they’d give up reoffending,” she mentioned.

The Instances of London reports that Flowers is dealing with three expenses below the Laptop Misuse Act: two of conspiracy to commit an unauthorized act in relation to a pc inflicting/creating threat of great injury to human welfare/nationwide safety and one among trying to commit the identical act. Most sentences for these offenses can vary from 14 years to life in jail, relying on the influence of the crime.

Jubair is reportedly dealing with two expenses within the U.Okay.: Certainly one of conspiracy to commit an unauthorized act in relation to a pc inflicting/creating threat of great injury to human welfare/nationwide safety and one among failing to adjust to a bit 49 discover to reveal the important thing to protected info.

In the USA, Jubair is charged with pc fraud conspiracy, two counts of pc fraud, wire fraud conspiracy, two counts of wire fraud, and cash laundering conspiracy. If extradited to the U.S., tried and convicted on all expenses, he faces a most penalty of 95 years in jail.

In July 2025, the UK barred victims of hacking from paying ransoms to cybercriminal teams except permitted by officers. U.Okay. organizations which might be thought of a part of important infrastructure reportedly will face an entire ban, as will your entire public sector. U.Okay. victims of a hack are actually required to inform officers to raised inform policymakers on the dimensions of Britain’s ransomware downside.

For additional studying (bless you), try Bloomberg’s poignant story final week based mostly on a yr’s price of jailhouse interviews with convicted Scattered Spider member Noah City.