Scattered Spider's 19-Year-Old Web-Slinger Lands in US Court 🕸️

A 19-year-old dual U.S.-Estonian citizen accused of belonging to the Scattered Spider hacking group has been extradited from Finland to face conspiracy, computer intrusion, and fraud charges in Chicago federal court. Peter Stokes appeared before a judge on Tuesday and was ordered held pending trial after Finnish police arrested him in April on an Interpol Red Notice, according to the U.S. Department of Justice.

According to the criminal complaint, Stokes and alleged co-conspirators breached a luxury jewelry retailer in May 2025 by placing phishing calls to the company's IT help desk and posing as employees requesting credential resets. Investigators said the attackers compromised three employee accounts within as little as two hours, including two belonging to IT administrators, then used those higher-privilege accounts to access internal systems. After exfiltrating data, the group sent a ransom note from a compromised company email account and later demanded approximately $8 million in cryptocurrency. The retailer evicted the intruders and did not pay, but suffered at least $2 million in losses tied to business disruption, investigation, and threat mitigation.

Prosecutors describe Scattered Spider, also tracked as Octo Tempest, UNC3944, and 0ktapus, as a loose collective that has executed more than 100 intrusions and collected over $100 million in ransoms. The group relies on social engineering rather than custom malware, calling help desks to impersonate staff, stealing or encrypting corporate data, and demanding crypto payments to restore access or suppress leaks. Its tactics powered 2023 attacks on MGM Resorts and Caesars Entertainment, the latter of which paid a roughly $15 million ransom, and members have also been linked to a previously unreported breach of Crypto.com. Investigators cited a Snapchat account tied to Stokes, who used the online nicknames "Bouquet" and "Jordan," that displayed what they called substantial wealth for his age along with international travel and references to apprehended Scattered Spider associates; an FBI-captured image shows him wearing a "Hack the Planet" necklace from the 1995 film Hackers.

Stokes is one of several alleged members now in U.S. custody. Alleged ringleader Tyler Buchanan, a 24-year-old Scot, pleaded guilty in April to a phishing spree that stole at least $8 million in crypto, and Florida's Noah Urban was sentenced to 10 years after reporting tied him to breaches including Crypto.com. The DOJ charged five alleged members in a separate 2024 crypto-phishing case, and the Stokes extradition falls under Operation Riptide, the FBI's broader cybercrime and fraud campaign that has yielded over 180 convictions since 2020 and the return of more than $350 million in victim funds, against a backdrop of Americans reporting over $20 billion in cybercrime losses last year, a 26% year-over-year jump.

Federal officials noted that crypto-linked ransom activity is shifting in scale. TRM Labs reported ransomware crews extorted about $850 million in crypto in 2025, roughly flat year over year, even as victim postings on leak sites jumped 44%, while Chainalysis found on-chain ransomware payments declined for a second consecutive year, with attackers appearing to compensate through more frequent intrusions. The Justice Department's Office of International Affairs and Finland's National Bureau of Investigation coordinated the Stokes extradition, and FBI Cyber Division Assistant Director Brett Leatherman said the case shows the bureau's commitment to pursuing Scattered Spider's members, who have "repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations."