British national with possible links to high-profile phishing campaigns arrested in Spain | CyberScoop<\/title> <meta name=\"description\" content=\"Authorities have yet to formally identify the 22-year-old British national, but reports suggest he was a prominent player in \u201cthe Com\u201d ecosystem.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"British national with possible links to high-profile phishing campaigns arrested in Spain\"> <meta property=\"og:description\" content=\"Authorities have yet to formally identify the 22-year-old British national, but reports suggest he was a prominent player in \u201cthe Com\u201d ecosystem.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-06-17T19:23:13+00:00\"> <meta property=\"article:modified_time\" content=\"2024-06-17T19:58:25+00:00\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1717605114g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1717522010g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1716385020g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=74528d75ce0daeb8628a\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/80742\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.5.4\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=80742\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fbritish-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fbritish-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-80742 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.847191011236\">\n<div class=\"single-article__header-content\" readability=\"31.515384615385\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> Authorities have yet to formally identify the 22-year-old, but reports suggest he was a prominent player in \u201cthe Com\u201d ecosystem. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"362\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain.png?resize=640%2C362&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png 2864w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=300,170 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=768,434 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=1024,579 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=1536,869 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=2048,1158 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=600,339 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=297,168 297w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=596,337 596w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=1193,675 1193w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain-1.png?resize=1490,843 1490w\" sizes=\"(max-width: 1193px) 100vw, 1193px\"><figcaption> Screenshot from a video shared by by the Spanish National Police Corps documenting their arrest of a 22-year-old British national on cybercrime charges. (Spanish National Police Corps) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"42.691015169195\"><body readability=\"86.116210214656\"><\/p>\n<p>The 22-year-old British man arrested by police in Spain last week is linked to an underground criminal group known as \u201cthe Com\u201d and allegedly participated in harvesting nearly 10,000 login credentials related to more than 130 companies as part of high-profile 2022 phishing campaign, a researcher familiar with the matter told CyberScoop on Monday.<\/p>\n<p>On Friday, Spanish police announced in <a href=\"https:\/\/www.policia.es\/_es\/comunicacion_prensa_detalle.php?ID=16236\">a statement<\/a> the arrest of an unidentified British national \u201cresponsible for the computer attack on 45 companies in the United States.\u201d <\/p>\n<p>The man was arrested at an airport in Palma \u2014 a resort city on the Spanish island of Mallorca \u2014 as he attempted to board a charter flight to Naples, police said.<\/p>\n<p>Spanish authorities said the man \u201cwas the leader of an organized group dedicated to the theft of information from companies and cryptocurrencies and gained control of 391 bitcoins worth more than $27 million.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>VX-Underground, an online malware research and repository, said in <a href=\"https:\/\/x.com\/vxunderground\/status\/1801962119316853148\">a post<\/a> Saturday on the social media platform X that the person arrested went by the name \u201cTyler\u201d and that he was a known sim-swapper \u201callegedly involved with the infamous Scattered Spider group\u201d and \u201cbelieved to be a key component of the MGM ransomware attack,\u201d referring to the <a href=\"https:\/\/cyberscoop.com\/las-vegas-mgm-caesars-cyber-attack\/\">September 2023 attack<\/a> on MGM Resorts.<\/p>\n<p>Cybersecurity journalist <a href=\"https:\/\/krebsonsecurity.com\/2024\/06\/alleged-boss-of-scattered-spider-hacking-group-arrested\/\">Brian Krebs subsequently reported<\/a> that \u201cTyler\u201d is Tyler Buchanan, a 22-year-old from Dundee, Scotland.<\/p>\n<p>The FBI declined to comment Monday, and referred questions to the Department of Justice. Neither the National Crime Agency in London nor the British Consulate General in Madrid responded to questions about the arrest. A person who answered the phone in the press office of the National Police Corps in Spain referred questions about the matter to colleagues in Palma, who could not be reached for comment.<\/p>\n<p>Speaking on condition of anonymity due to the threats facing researchers and others focused on the criminal ecosystem known as the Com, the researcher familiar with the matter cautioned that it\u2019s not clear whether Buchanan was part of the group that attacked MGM. <\/p>\n<p>Buchanan was allegedly part of the group that carried out a phishing campaign <a href=\"https:\/\/www.group-ib.com\/blog\/0ktapus\/\">dubbed \u201c0ktapus\u201d by cybersecurity firm Group-IB<\/a>, wherein nearly 10,000 username\/password credentials associated with more than 130 companies were harvested as part of a massive 2022 phishing campaign, the researcher said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p><a href=\"https:\/\/www.twilio.com\/en-us\/blog\/august-2022-social-engineering-attack\">Twilio<\/a>, a cloud communications and marketing company, and <a href=\"https:\/\/blog.cloudflare.com\/2022-07-sms-phishing-attacks\/\">Cloudflare<\/a>, a content delivery network provider, were two prominent targets of that campaign.<\/p>\n<p>In January, federal authorities <a href=\"https:\/\/www.justice.gov\/usao-mdfl\/pr\/palm-coast-man-arrested-wire-fraud-and-aggravated-identity-theft-charges\">arrested 19-year-old Noah Michael Urban in Florida<\/a> for his alleged role in stealing at least $800,000 from at least five different victims as part of a cybercriminal operation in 2022 and 2023. Urban \u2014 who went by \u201cSosa,\u201d \u201cElijah,\u201d \u201cKing Bob,\u201d and \u201cAnthony Ramirez\u201d online \u2014 was part of the group with Buchanan who carried out the 0ktapus campaign, the researcher told CyberScoop. <\/p>\n<p>The use of the term \u201cScattered Spider\u201d to refer to a group of aggressive criminal hackers <a href=\"https:\/\/www.crowdstrike.com\/adversaries\/scattered-spider\/\">was coined by the cybersecurity firm Crowdstrike<\/a>, but that group is <a href=\"https:\/\/cyberscoop.com\/youth-hacking-ring-at-the-center-of-cybercrime-spree\/\">more of an ecosystem<\/a> made up of primarily young and brash personas, some of whom participate in various financially motivated cybercrimes or other criminal activity. People within the community refer to it as the Com, and subgroups within it engage in various criminal conspiracies that include extortion, violence as a service and sim-swapping.<\/p>\n<p>A senior <a href=\"https:\/\/cyberscoop.com\/potent-youth-cybercrime-ring-made-up-of-1000-people-fbi-official-says\/\">FBI official told a cybersecurity conference<\/a> last month that roughly 1,000 people compose the threat broadly defined as Scattered Spider, although it\u2019s not clear how the bureau made that determination. The cybercriminals in that ecosystem present a top-three cybersecurity threat, said Bryan Vorndran, assistant director of the FBI\u2019s cyber division, alongside the foreign intelligence agencies of China and Russia.<\/p>\n<p><strong><em>This story was updated June 17, 2024, to note that the FBI declined to comment.<\/em><\/strong><\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.1688311688312\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/06\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>British national with possible links to high-profile phishing campaigns arrested<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2196,282,669,984],"tags":[2197,286,671,986],"class_list":["post-4064","post","type-post","status-publish","format-standard","hentry","category-0ktapus","category-cybercrime","category-federal-bureau-of-investigation-fbi","category-the-com","tag-0ktapus","tag-cybercrime","tag-federal-bureau-of-investigation-fbi","tag-the-com"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/0ktapus\/\" rel=\"category tag\">0ktapus<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/the-com\/\" rel=\"category tag\">The Com<\/a>","tag_info":"The Com","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4064"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4064\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":4064,"date":"2024-06-17T14:23:13","date_gmt":"2024-06-17T19:23:13","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=80742"},"modified":"2024-06-17T14:23:13","modified_gmt":"2024-06-17T19:23:13","slug":"british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/06\/17\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/","title":{"rendered":"British national with possible links to high-profile phishing campaigns arrested in Spain"},"content":{"rendered":"