CyberSIXT Search
Original

Krebs on SecurityBrianKrebs

Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms

Part of the Scattered Spider story · 58 articles · 11 outlets · since 28 Aug 2025

U.S. prosecutors have charged 19-year-old Thalha Jubair and 18-year-old Owen Flowers in connection with Scattered Spider, a group prosecutors say extorted at least $115 million in ransom payments from victims. The charges emerged as Jubair and Flowers appeared in a London court, with UK prosecutors detailing alleged involvement in an August 2024 attack that disrupted Transport for London and other targeted organisations.

The United States complaint also alleges that Jubair and other Scattered Spider members were linked to attacks on MGM Resorts and Caesars Entertainment in September 2023, and that Jubair’s cryptocurrency wallet helped fund illicit activity, including purchases tied to a food delivery service and online gaming accounts; authorities say they seized $36 million in cryptocurrency from a server tied to Jubair.

According to The Times of London, Flowers faces three charges under the Computer Misuse Act, while Jubair faces multiple charges in both the U.K. and the United States; the Times also notes a potential maximum of 95 years’ imprisonment if convicted in the U.S. In July 2025, the UK banned ransom payments by most organisations in critical infrastructure, with broader prohibitions announced for the public sector.

Story timeline Scattered Spider

Full timeline
Show as table
Scattered Spider coverage
Published (UTC)OutletHeadline
Wed 24 Sep 2025 · 12:05 UTCKrebs on SecurityFeds Tie ‘Scattered Spider’ Duo to $115M in Ransoms (this article)
Fri 26 Jun · 15:00 UTCSecurityWeekWeekly Security Roundup: Cellebrite, Tata Hack, AI Warnings
Wed 1 Jul · 20:12 UTCThe Hacker News19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
Thu 2 Jul · 03:02 UTCSecurityOnlineTeen dual citizen extradited for Scattered Spider cyber extortion
Thu 2 Jul · 08:11 UTCSecurity AffairsTeen Peter Stokes Extradited to US Over $8m Jewelry Heist
Thu 2 Jul · 09:21 UTCInfosecurityUS extradites teen hacker linked to $100M Scattered Spider scheme
Fri 3 Jul · 09:51 UTCSecurityWeekUS extradites alleged Scattered Spider teen over jewelry heist
Mon 6 Jul · 17:42 UTCSecurityOnlineUS extradites hacker after Microsoft GDID tracks him despite VPN
Tue 7 Jul · 14:00 UTCThe Hacker NewsFBI tracks alleged Scattered Spider via Windows Device ID
Tue 7 Jul · 14:32 UTCInfosecurityScattered Spider’s Structure More Like a Cybercrime Collective Than a Unified Gang
Thu 16 Jul · 12:20 UTCInfosecurityTeen hackers jailed for Transport for London cyberattack
Thu 16 Jul · 13:25 UTCSecurityWeekScattered Spider pair jailed five years for £29m TfL hack
Thu 16 Jul · 18:40 UTCThe Hacker NewsScattered Spider duo jailed 5.5 years for £29m TfL cyberattack
Thu 16 Jul · 18:40 UTCSecurity AffairsScattered Spider duo sentenced 5.5 years for £29m TfL cyberattack
Tue 22 Sep · 13:30 UTCDataBreachesTexas Man Admits Role in Scattered Spider Extortion Scheme

Sources

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.

↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device