Scattered Spider is a loose, largely English-speaking cybercrime collective known for talking its way into networks. CISA says members impersonate employees or IT staff to persuade help desks to reset passwords and transfer MFA, use SIM swapping and targeted phishing, and buy stolen credentials. Once inside they deploy legitimate remote access tools, steal data from cloud platforms such as Snowflake and extort victims; CISA's July 2025 update added deployment of DragonForce ransomware. The group has also compromised third parties to reach multiple downstream targets.
LatestOn 16 July 2026 Thalha Jubair and Owen Flowers were each sentenced to five years and six months over the 2024 Transport for London attack, after pleading guilty on 22 June; Jubair also faces a US complaint. In the US, Tyler Buchanan pleaded guilty on 17 April 2026 to wire fraud conspiracy and aggravated identity theft, with sentencing set for 21 August 2026.
Timeline
UK national Tyler Buchanan was arrested in Spain in June 2024 (reported).
KrebsOnSecurity — 'Scattered Spider' member 'Tylerb' pleads guilty (21 Apr 2026)
US prosecutors in Los Angeles unsealed charges against five men, including Noah Michael Urban and Tyler Robert Buchanan, over SMS phishing of company employees and cryptocurrency theft.
Buchanan entered US federal custody in April 2025; Urban pleaded guilty the same month.
Noah Michael Urban was sentenced to 10 years in prison and ordered to pay $13 million in restitution.
CyberScoop — Florida man gets 10 years in prison in first Scattered Spider sentencing (21 Aug 2025)
The NCA and City of London Police arrested Thalha Jubair and Owen Flowers at their homes over the August-September 2024 attack on Transport for London.
The DOJ unsealed a complaint charging Jubair over at least 120 intrusions and more than $115 million in ransom payments.
Buchanan pleaded guilty in federal court to wire fraud conspiracy and aggravated identity theft, admitting thefts of at least $8 million in cryptocurrency.
Jubair and Flowers pleaded guilty on the first day of trial at Woolwich Crown Court.
Jubair and Flowers were each sentenced to five years and six months in prison.
Who is exposed, and what holds
Who is exposed
- Organisations whose IT help desks can reset passwords or MFA on the strength of a phone call
- Large enterprises with outsourced IT support and third-party access into their networks
- Users of SMS-based MFA vulnerable to SIM swapping
Recommended controls
- Adopt FIDO2/WebAuthn phishing-resistant MFA, as CISA recommends
- Require out-of-band identity verification before any help-desk credential or MFA reset
- Restrict and monitor remote access tools, and alert on new MFA device registrations
Sources
- CISA — AA23-320A Scattered Spider (updated 29 Jul 2025)
- NCA — Two sentenced for hacking Transport for London in UK's biggest ever cyber crime case (16 Jul 2026)
- NCA — Cyber criminals who hacked into Transport for London's computer network are convicted (22 Jun 2026)
- US DOJ — United Kingdom national charged in connection with multiple cyber attacks, including on critical infrastructure (18 Sep 2025)
- US DOJ (C.D. Cal.) — British national pleads guilty to hacking into companies and stealing at least $8 million in virtual currency (17 Apr 2026)
- US DOJ (C.D. Cal.) — 5 defendants charged federally with running scheme that targeted victim companies via phishing text messages (20 Nov 2024)
- CyberScoop — Leading members of Scattered Spider sentenced in UK to 66 months (17 Jul 2026)
- KrebsOnSecurity — 'Scattered Spider' member 'Tylerb' pleads guilty (21 Apr 2026)