US Extradites Peter Stokes to Face Charges Over Alleged Scattered Spider Hacks
Summary
The U.S. extradited Peter Stokes from Finland to face charges over alleged Scattered Spider intrusions. The FBI says attackers used help-desk social engineering and credential resets in a jewelry retailer breach, then demanded $8 million.
Key points
- Peter Stokes, a 19-year-old dual U.S.-Estonian citizen, was extradited from Finland to Chicago and charged with alleged participation in cyber intrusions and fraud.
- The FBI alleges attackers impersonated retailer employees, used calls to the IT help desk to reset credentials, and compromised three accounts, including two IT administrator accounts.
- The complaint says the attackers allegedly stole data from the luxury-jewelry retailer and demanded an $8 million cryptocurrency ransom.
- The FBI alleges the suspects used Google Voice numbers and ngrok to maintain unauthorized access to the retailer’s data center.
- According to the FBI, the retailer did not pay the ransom; business disruption, investigation, and mitigation losses were estimated at about $2 million.
- The complaint also accuses Stokes of unauthorized access to an online-communication platform in March 2023.
Article Details
- Event Type
- Extradition and federal charges concerning alleged cybercrime
- Impact
- The FBI alleges that Peter Stokes and possibly other Scattered Spider members breached a luxury-jewelry retailer, compromised three employee accounts (including two IT administrators’ accounts), stole data, and demanded an $8 million cryptocurrency ransom. The retailer did not pay; the FBI estimates losses of approximately $2 million, with further losses expected. The complaint also alleges that Stokes accessed an online-communication platform without authorization.
MITRE ATT&CK
Threat Actors
JordanThe article identifies Jordan as an alias allegedly used by Peter Stokes, who is accused of participating in Scattered Spider cyber intrusions and fraud.Peter StokesThe FBI alleges that Stokes participated in Scattered Spider intrusions and fraud, including the breach of a luxury-jewelry retailer and unauthorized access to an online-communication platform. The allegations are not presented as established findings.Scattered SpiderThe FBI alleges that Scattered Spider members used phishing and social engineering to reset credentials, steal data, and demand ransom. The U.S. government estimates the group has been involved in more than 100 network intrusions and collected more than $100 million in ransom payments.SpencerThe article identifies Spencer as an alias allegedly used by Peter Stokes, who is accused of participating in Scattered Spider cyber intrusions and fraud.
Tools
Countries
FinlandA 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was extradited from Finland to Chicago and charged for allegedly taking part in Scattered Spider attacks, including a breach of a luxury-jewelry retailer.United StatesA 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was extradited from Finland to Chicago and charged for allegedly taking part in Scattered Spider attacks, including a breach of a luxury-jewelry retailer.