US charges five in ‘Scattered Spider’ hacking scheme

By Jonathan Stempel

(Reuters) – U.S. prosecutors unveiled criminal charges on Wednesday against five alleged members of Scattered Spider, a cybercrime group suspected of hacking into dozens of U.S. companies to steal confidential information and cryptocurrency.

Martin Estrada, the U.S. Attorney in Los Angeles, said the defendants conducted phishing attacks by sending bogus but real-looking mass text messages to employees’ mobile phones warning that their accounts would be deactivated.

The hackers, in their teens or 20s at the time, allegedly directed employees to links for entering log-in information, enabling the hackers to steal from their employers and millions of dollars of cryptocurrency from individuals’ accounts.

Victims allegedly included at least 12 companies in the gaming, outsourcing, telecommunications and cryptocurrency fields, plus hundreds of thousands of individuals. Estrada’s office confirmed that the case concerned Scattered Spider.

The defendants are Tyler Buchanan, 22, of Scotland; Ahmed Elbadawy, 23, of College Station, Texas; Joel Evans, 25, of Jacksonville, North Carolina; Evans Osiebo, 20, of Dallas; and Noah Urban, 20, of Palm Coast, Florida.

Each was charged with two conspiracy counts and aggravated identity theft, and Buchanan was also charged with wire fraud.

Investigators traced Buchanan through domain registration records for phishing websites, registered under an account whose user name included the name of late actor Bob Saget.

Hackers including from Scattered Spider drew notoriety in September 2023, when they broke into and locked up the networks of casino operators Caesars Entertainment and MGM Resorts International, and demanded hefty ransom payments.

Security experts have tracked the group since at least 2022, viewing it as unusually aggressive among cybercrime gangs. Caesars paid about $15 million to restore its network.

“Phishing and hacking has become increasingly sophisticated and can result in enormous losses,” Estrada said in a statement. “If something about the text or email you received or website you’re viewing seems off, it probably is.”

Evans was arrested on Tuesday in North Carolina. Urban has pleaded not guilty to 14 fraud and conspiracy charges in a separate case in Florida.

A public defender representing Urban did not immediately respond to a request for comment. Lawyers for the other defendants could not immediately be identified.

(Reporting by Jonathan Stempel in New York; Editing by Bill Berkrot)