Loading story…
U.S. prosecutors charged 19-year-old dual U.S.-Estonian citizen Peter Stokes over an alleged Scattered Spider intrusion in which attackers socially engineered a luxury retailer’s IT help desk, reset credentials and MFA, accessed privileged accounts, stole data, and attempted to extort the company for $8 million in cryptocurrency. Court filings say the May 2025 attack caused roughly $2 million in operational losses even though the victim restored access without paying, and investigators say at least 77 GB of data was exfiltrated during the breach.
Authorities said Microsoft telemetry played a central role in identifying Stokes, with a persistent Windows Global Device Identifier (GDID) tying activity from the intrusion to his device and online accounts. Investigators also linked infrastructure used in the attack, including ngrok tunneling and a Tzulo-hosted VPN proxy, before correlating the same identifier with accounts on Apple, Snapchat, Facebook, and Ubisoft/Growtopia across locations including Estonia, New York, and Thailand. Stokes was arrested in Finland while attempting to board a flight to Japan, extradited to the United States, and now faces federal charges including conspiracy, computer intrusion, wire fraud, and violations of the Computer Fraud and Abuse Act.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Microsoft publicly acknowledged the Windows Global Device Identifier (GDID), a persistent identifier associated with Windows installations using a Microsoft Account. Reporting said GDID is generated during provisioning, persists across updates, and lacks a standard user-facing option to view, reset, or disable it without affecting some Microsoft services.
A Justice Department complaint described how investigators used Microsoft’s Global Device Identifier, along with ngrok, Tzulo, and IP address records, to connect account activity to a Windows device allegedly tied to Peter Stokes in Estonia. The filing also alleged Scattered Spider accessed more than 100 corporate networks and obtained over $100 million in ransom payments.
Prosecutors allege Peter Stokes participated in a May 2025 social-engineering intrusion against a U.S. luxury jewelry retailer, using help-desk impersonation and MFA reset tactics to access privileged accounts. Attackers stole data, used ngrok for tunneling, exfiltrated at least 77 GB, and attempted to extort the victim for $8 million in cryptocurrency.
After extradition to the United States, Peter Stokes appeared in federal court in Chicago. He faces federal charges including conspiracy, computer intrusion, wire fraud, and Computer Fraud and Abuse Act violations.
Authorities arrested Peter Stokes in Finland while he was attempting to board a flight to Japan. The arrest was carried out with assistance from U.S. authorities, the FBI, Finland's National Bureau of Investigation, and Microsoft.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcewindowslatest.com
Open sourcetomshardware.com
Open sourcecyberveille.ch
Open sourcetomshardware.com
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourcehelp.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors have charged 19-year-old dual U.S.-Estonian citizen Peter Stokes, allegedly a member of the **Scattered Spider** cybercrime group who used the alias `Bouquet`, after his arrest in Finland on April 10. According to reports citing court records, Stokes was detained while allegedly attempting to board a flight to Tokyo and now faces wire fraud, conspiracy, and computer intrusion charges in a sealed six-count complaint, with U.S. authorities seeking his extradition to Chicago. Investigators allege he took part in at least four intrusions, including a 2023 breach of an online communications platform and other attacks carried out while he was still a teenager. The complaint links Stokes to Scattered Spider operations that relied on help-desk social engineering, credential resets, MFA fatigue, and SMS phishing to gain access to major corporate environments. One 2025 intrusion described in the filings allegedly targeted a multibillion-dollar luxury retailer, where attackers obtained administrator access, claimed to have stolen **100 GB** of data, and issued an **$8 million** extortion demand, causing more than **$2 million** in losses. The case adds to broader law-enforcement pressure on the financially motivated group, also tracked as **Octo Tempest**, which has been tied to intrusions affecting MGM Resorts, Caesars, Twilio, Reddit, Riot Games, Mailchimp, DoorDash, Harrods, Marks & Spencer, WestJet, and Jaguar Land Rover.
Jul 3, 2026
U.S. prosecutors unsealed charges against five men allegedly linked to the **Scattered Spider** cybercrime ecosystem, accusing them of running a large-scale scheme that used SMS phishing, spoofed login pages, social engineering, stolen employee credentials, email hijacking, and SIM swapping to compromise companies and individuals. Court filings say the operation targeted technical employees across the United States between September 2021 and April 2023, enabling the theft of non-public corporate data, personal identifiers, and **millions of dollars in cryptocurrency**. Four suspects were charged in the United States with conspiracy to commit wire fraud, while a separate complaint was filed against a fifth defendant in the United Kingdom. The case adds to mounting law-enforcement scrutiny of Scattered Spider, a loose English-speaking threat actor network also tracked under multiple aliases and associated with the broader **"Com"** ecosystem. Authorities and researchers have linked the group to high-profile intrusions and collaborations with ransomware operations including **BlackCat/ALPHV**, **Qilin**, and **RansomHub**, as well as incidents affecting MGM Resorts, Clorox, Snowflake-linked victims, and later investigations into the hacks at **Marks & Spencer** and **Co-op**. The charges mark a significant escalation in efforts to disrupt a group known for blending phishing, identity takeover, and extortion-focused intrusion tactics.
Jun 29, 2026
Tyler Robert Buchanan, a 24-year-old British national from Dundee, Scotland, pleaded guilty in U.S. federal court in California to **conspiracy to commit wire fraud** and **aggravated identity theft** for his role in Scattered Spider’s large-scale social-engineering operation. Prosecutors said Buchanan and co-conspirators ran SMS phishing campaigns from September 2021 to April 2023 that impersonated corporate IT help desks and labor providers, used fake login pages and stolen credentials, and carried out SIM swapping to breach companies and individuals. The Justice Department said the scheme stole at least **$8 million in virtual currency** from U.S. victims across telecommunications, technology, cloud communications, outsourcing, gaming, and cryptocurrency sectors. Investigators tied Buchanan to the 2022 **0ktapus** campaign, which used fake Okta login pages to compromise more than 130 organizations, including **Twilio** and **Cloudflare**, and enabled downstream attacks affecting other major brands. Authorities said stolen credentials were funneled into a Telegram channel administered by Buchanan and an associate, and searches of his residence in Scotland uncovered victim company files, personal data, and roughly 20 devices. Buchanan was arrested in Palma de Mallorca by Spanish authorities, extradited to the United States, and has been in federal custody since April 2025; he now faces up to 22 years in prison, underscoring continued law-enforcement pressure on the loosely organized Scattered Spider group, an offshoot of **The Com**.
Jun 29, 2026