Police nab 17-year-old linked to group behind MGM Resorts cyberattack | CyberScoop<\/title> <meta name=\"description\" content=\"The person arrested by British authorities is believed to be linked to the cybercriminal ecosystem known as \u201cthe Com.\u201d \"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/mgm-ransomware-attack-arrest-com-uk-police\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Police nab 17-year-old linked to group behind MGM Resorts cyberattack\"> <meta property=\"og:description\" content=\"The person arrested by British authorities is believed to be linked to the cybercriminal ecosystem known as \u201cthe Com.\u201d \"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/mgm-ransomware-attack-arrest-com-uk-police\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-07-22T21:24:18+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1721147539g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1721117550g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1721183474g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ada0ad45b21fc79c6694\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/81107\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.6\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=81107\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fmgm-ransomware-attack-arrest-com-uk-police%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fmgm-ransomware-attack-arrest-com-uk-police%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-81107 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/mgm-ransomware-attack-arrest-com-uk-police\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \">\n<div class=\"single-article__header-content\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> An exterior view shows the marquee at MGM Grand Hotel & Casino left of the Leo the Lion statue on the Las Vegas Strip on August 28, 2020 in Las Vegas, Nevada. (Photo by Ethan Miller\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"35.646960865945\"><body readability=\"72.516572111078\"><\/p>\n<p>A 17-year-old arrested by British police Thursday is believed to be a member of the cybercriminal gang behind last year\u2019s ransomware attack on MGM Resorts and a number of other major companies.<\/p>\n<p>The unidentified boy was released on bail as the investigation, which includes examination of a number of digital devices, continues, police said in a statement. The arrest was part of a global investigation \u201cinto a large-scale cyber hacking community,\u201d the <a href=\"https:\/\/www.westmidlands.police.uk\/news\/west-midlands\/news\/news\/2024\/july\/walsall-teenager-arrested-in-joint-west-midlands-police-and-fbi-operation\/\">West Midlands Police said<\/a>. <\/p>\n<p>The West Midlands Regional Organised Crime Unit worked with the U.K.\u2019s National Crime Agency and the FBI to make the arrest in Walsall, a town about nine miles northwest of Birmingham. <\/p>\n<p>The statement did not include details about the boy or his alleged role in the Las Vegas attacks. The global entertainment and casino company determined it had been attacked <a href=\"https:\/\/investors.mgmresorts.com\/investors\/news-releases\/press-release-details\/2023\/MGM-RESORTS-UPDATE-ON-RECENT-CYBERSECURITY-ISSUE\/default.aspx\">on Sept. 29, 2023<\/a>, and said in an October 2023 Securities and Exchange Commission filing that the attack cost the company <a href=\"https:\/\/www.sec.gov\/ix?doc=\/Archives\/edgar\/data\/789570\/000119312523251667\/d461062d8k.htm\">more than $100 million<\/a> in direct and indirect costs.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The FBI referred questions about the suspect to the West Midlands Police, who did not immediately respond to a request for additional detail.<\/p>\n<p>The arrest of the unidentified boy is the latest in a string of law enforcement moves targeting a dispersed and nebulous cybercriminal ecosystem known as \u201c<a href=\"https:\/\/cyberscoop.com\/tag\/the-com\/\">the Com<\/a>,\u201d which includes various, sometimes rival subgroups that cooperate on aspects of criminal operations. <\/p>\n<p>Industry researchers track the group\u2019s activity under the \u201cScattered Spider\u201d moniker and terms such as Octo Tempest, 0ktapus, Scatter Swine or Muddled Libra.<\/p>\n<p>Last month, <a href=\"https:\/\/cyberscoop.com\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/\">Spanish authorities arrested<\/a> Tyler Buchanan, a 22-year-old British man with ties to the Com. Researchers say Buchanan was an active sim-swapper and is tied to a 2022 Com-related phishing campaign that harvested nearly 10,000 login credentials related to more than 130 companies.<\/p>\n<p>In January, federal authorities <a href=\"https:\/\/www.justice.gov\/usao-mdfl\/pr\/palm-coast-man-arrested-wire-fraud-and-aggravated-identity-theft-charges\">arrested 19-year-old Noah Michael Urban in Florida<\/a> for his alleged role in stealing at least $800,000 from at least five different victims as part of a cybercriminal operation in 2022 and 2023. Urban \u2014 who went by \u201cSosa,\u201d \u201cElijah,\u201d \u201cKing Bob,\u201d and \u201cAnthony Ramirez\u201d online \u2014 was part of the group with Buchanan, a researcher familiar told CyberScoop after Buchanan\u2019s arrest.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cThese cyber groups have targeted well-known organizations with ransomware and they have successfully targeted multiple victims around the world taking from them significant amounts of money,\u201d Detective Inspector Hinesh Mehta of the West Midlands Cyber Crime Unit said in the statement. <\/p>\n<p>MGM Resorts did not respond to a request for comment Monday. But in the West Midlands statement, MGM said it was \u201cproud to have assisted law enforcement in locating and arresting one of the alleged criminals responsible for the cyber attack against MGM Resorts and many others.\u201d<\/p>\n<p>Ransomware attacks connected to the Com include the use of ransomware variants such as RansomHub and Qilin, <a href=\"https:\/\/x.com\/MsftSecIntel\/status\/1812932749314978191\">Microsoft Threat Intelligence reported July 15<\/a>. The group had previously used the ALPHV\/BlackCat ransomware, including in the MGM Resorts attack.<\/p>\n<p>Multiple teams at Microsoft, including the company\u2019s Digital Crimes Unit, provided information that helped lead to last week\u2019s arrest, the company told CyberScoop.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.0731225296443\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/07\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/mgm-ransomware-attack-arrest-com-uk-police\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Police nab 17-year-old linked to group behind MGM Resorts cyberattack<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,669,2377,953,984],"tags":[286,671,2378,958,986],"class_list":["post-4590","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-federal-bureau-of-investigation-fbi","category-octo-tempest","category-scattered-spider","category-the-com","tag-cybercrime","tag-federal-bureau-of-investigation-fbi","tag-octo-tempest","tag-scattered-spider","tag-the-com"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/octo-tempest\/\" rel=\"category tag\">Octo Tempest<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/scattered-spider\/\" rel=\"category tag\">Scattered Spider<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/the-com\/\" rel=\"category tag\">The Com<\/a>","tag_info":"The Com","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4590"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4590\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":4590,"date":"2024-07-22T16:24:18","date_gmt":"2024-07-22T21:24:18","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=81107"},"modified":"2024-07-22T16:24:18","modified_gmt":"2024-07-22T21:24:18","slug":"police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/07\/22\/police-nab-17-year-old-linked-to-group-behind-mgm-resorts-cyberattack\/","title":{"rendered":"Police nab 17-year-old linked to group behind MGM Resorts cyberattack"},"content":{"rendered":"