← threat actors
how they got in
- sms 1 · Sep 25
- stolen credentials 1 · Jul 27
sectors
- transport 3 · Jul 19
- crypto 1 · Sep 25
- retail 1 · Jul 2
geography
- uk 2 · Jul 19
- united kingdom 1 · Jul 17
- estonia 1 · Jul 2
- finland 1 · Jul 2
- united states 1 · Jul 2
techniques
- phishing 1 · Sep 25
- credential theft 1 · Jul 27
- social engineering 1 · Jul 27
- credential access 1 · Jul 19
- ransomware 1 · Jul 17
attack phases seen
- Initial access 4 · Sep 25
- Credential access 1 · Jul 27
- Impact 1 · Jul 17
- Exfiltration 1 · Jul 2
- Persistence 1 · Jul 2
what we reported, newest first, grouped by story
September 25, 2026
- Scattered Spider member Ahmed Hossam Eldin Elbadawy sentenced to 45 months after guilty pleas to wire fraud conspiracy and aggravated identity theft, over phishing texts impersonating employers and IT providers from September 2021 to April 2023 used to reach cryptocurrency accounts. DarkWebInformer
· Sep 25 · observed · via sms · Industry & Policy
July 27, 2026
- A Scattered Spider sentencing offered a rare inside look at TTPs — heavy reliance on stolen credentials, social engineering, compromised third-party infrastructure, and shared tooling, underscoring identity and account-recovery hardening (AITM Feed).
· Jul 27 · observed · via stolen credentials · Threat Activity
Jul 17 – July 19, 2026 · 2 reports
- Scattered Spider duo sentenced to 5.5 years each. Thalha Jubair, 20, and Owen Flowers, 18, were sentenced at Woolwich Crown Court over the 2024 Transport for London attack, which left 148 TfL systems inoperable, forced in-person password resets for 27,000 staff and caused ~£29 million in damages — the UK's largest cybercrime prosecution (The Hacker News, Intel 471).
· Jul 19 · observed · Threat Activity
- Scattered Spider members Owen Flowers (18) and Thalha Jubair (20) were each sentenced to 5.5 years — the UK's largest cybercrime prosecution — for the 2024 Transport for London ransomware attack that hit 7 million users and cost TfL £29M (The Record, BleepingComputer, The Register).
· Jul 17 · observed · Threat Activity
July 5, 2026
- Court docs in the Scattered Spider case reveal Microsoft's "GDID" device tracking. Filings against extradited suspect Peter Stokes describe a Global Device Identifier tied to each Windows install that reported IPs, web activity, timestamps, and even game activity to Microsoft — a largely undocumented telemetry identifier that helped the FBI place him behind Ngrok tunnels. vx-underground
· Jul 5 · observed · Threat Activity
July 2, 2026
- Peter Stokes, a 19-year-old US–Estonian dual citizen using the alias "Bouquet," was extradited from Finland to a Chicago federal court after being detained at Helsinki Airport in April 2026 while trying to board a flight to Japan. The DOJ complaint links him to Scattered Spider activity spanning 100+ intrusions, ~$100M in ransom payments, and a 2025 breach of a "luxury-jewelry retailer." The Record, DOJ.
· Jul 2 · observed · Threat Activity
June 23, 2026
- Two Scattered Spider members plead guilty to the TfL attack — Thalha Jubair (20) and Owen Flowers (18) admitted the Transport for London intrusion that cost tens of millions; sentencing is set for July 16, 2026, with the NCA noting Flowers violated release conditions twice. NCA
· Jun 23 · observed · Threat Activity