Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
Summary: A newly unsealed federal complaint says U.S. prosecutors tied an alleged Scattered Spider hacker to a May 2025 break-in at a luxury jewelry retailer through a persistent Windows device identifier, g:6755467234350028, which Microsoft records linked to the ngrok account used in the intrusion and then to accounts attributed to 19-year-old Peter Stokes. Between May 12 and 15, 2025, attackers called the retailer's IT help desk from Google Voice numbers posing as locked-out employees, took over three accounts including two IT administrators', installed ngrok and Teleport, exfiltrated at least 77 gigabytes, and demanded $8 million in cryptocurrency after their ransomware attempt was blocked.
Key Takeaway: The breach cost the retailer about $2 million even though it refused to pay, and the entry point was a help desk password reset, not a software flaw. Group-IB's research cited here argues Scattered Spider is a loose collective of cells no larger than five people, so one arrest leaves the shared playbook and more than 100 intrusions behind it intact.
Read the original at The Hacker News ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026