A 19-year-old dual US-Estonian national was arrested in Finland and extradited to the US for alleged involvement with the hacking group Scattered Spider, according to the US Department of Justice (DoJ). Peter Stokes was taken into custody in April and appeared in federal court in Chicago, where he was ordered to remain in custody pending further proceedings. The DoJ stated that Stokes faces charges of computer intrusion, conspiracy, and fraud, which it described as the result of “years of work.”

Scattered Spider’s Global Cybercrime Network

Scattered Spider. Also known as “Octo Tempest. ” “UNC3944. ” or “0ktapus. ” is a criminal hacking group that has been linked to over 100 network intrusions globally; these intrusions have led to more than $100 million in ransom payments and millions in damages, according to the FBI. The group is known for targeting companies with ransom demands, often in cryptocurrency, and has been connected to cyberattacks in the US and the UK.

In June. Two men in the UK pleaded guilty to a cyberattack on Transport for London (TfL), a government body responsible for the city’s transport network; Thalha Jubair, 20, and Owen Flowers, 18, breached TfL’s network between August 31 and September 3, 2024, according to the National Crime Agency (NCA). The attack forced all 28. 000 TfL employees to attend a company office for a password reset, and the organization reported £29 million in loss and recovery costs.

Unpaid Ransom and Financial Losses

In a separate case, the DoJ stated that Stokes and his co-conspirators had demanded around $8 million in cryptocurrency from a luxury jewellery retailer after stealing its data. However, the company’s security personnel were able to remove the threat actors from its computer network, and no ransom was paid. Despite this, the retailer reportedly suffered at least $2 million in losses due to business disruption, investigation, and mitigation efforts.

The NCA said that Scattered Spider is a key part of ongoing investigations into cyberattacks on British retailers, including Co-op and Marks & Spencer (M&S), in the UK. The group’s members are believed to be young, native English speakers from the US and UK, and the UK National Cyber Crime Unit has highlighted the growing threat they pose.

International Collaboration in Cybersecurity

According to the DoJ, the operation against Stokes involved collaboration between the FBI, which worked in both Copenhagen and Chicago, and Finland’s National Bureau of Investigation. The arrest came after an Interpol Red Notice was issued, and Stokes was extradited to the US following his arrest in Finland. The DoJ described the charges as a significant step in efforts to hold cybercriminals accountable for their actions.