US charges five men linked to \u2018Scattered Spider\u2019 with wire fraud | CyberScoop<\/title> <meta name=\"description\" content=\"Five members of the "Scattered Spider" cybercrime syndicate have been indicted and accused of a nationwide phishing scheme.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/federal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\" US charges five men linked to \u2018Scattered Spider\u2019 with wire fraud\"> <meta property=\"og:description\" content=\"Five members of the "Scattered Spider" cybercrime syndicate have been indicted and accused of a nationwide phishing scheme.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/federal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-11-20T20:19:38+00:00\"> <meta property=\"article:modified_time\" content=\"2024-11-20T20:19:41+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Greg Otto\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@gregotto\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1731444340g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1730999764g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1732010462g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ddc036fa194c40cf406f\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/82694\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=82694\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ffederal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Ffederal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-82694 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/federal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.111510791367\">\n<div class=\"single-article__header-content\" readability=\"32.984848484848\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/federal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> The men have been charged with conspiracy to commit wire fraud. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/82694\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> A pedestrian walks past a seal reading “Department of Justice Federal Bureau of Investigation”, displayed on the J. Edgar Hoover FBI building, in Washington, DC, on August 15, 2022. (Photo by MANDEL NGAN\/AFP via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"36.65141955836\"><body readability=\"73.714636391531\"><\/p>\n<p>Federal authorities unsealed charges Wednesday against five individuals with links to the \u201cScattered Spider\u201d cybercrime syndicate, accusing them of conducting an extensive phishing scheme that compromised companies nationwide, enabling the theft of non-public data and millions in cryptocurrency. <\/p>\n<p>Ahmed Hossam Eldin Elbadawy, 23, of Texas; Noah Michael Urban, 20, of Florida; Evans Onyeaka Osiebo, 20, of Texas; and Joel Martin Evans, 25, of North Carolina, have been charged with conspiracy to commit wire fraud, for allegedly sending phishing messages to various technical employees to capture login credentials, which were then illicitly used to access and exploit corporate and individual accounts. <\/p>\n<p>A separate complaint was filed against Tyler Robert Buchanan, 22, from the United Kingdom, for similar crimes.<\/p>\n<p>Evans was arrested Tuesday by the FBI in North Carolina and is expected to make his initial court appearance Wednesday. Urban was <a href=\"https:\/\/www.justice.gov\/usao-mdfl\/pr\/palm-coast-man-arrested-wire-fraud-and-aggravated-identity-theft-charges\">arrested in January<\/a> in Florida after being indicted on separate federal wire fraud and aggravated identity theft charges. Buchanan was <a href=\"https:\/\/cyberscoop.com\/british-national-with-possible-links-to-high-profile-phishing-campaigns-arrested-in-spain\/\">arrested in June<\/a> by Spanish police for being \u201cresponsible for the computer attack on 45 companies in the United States.\u201d <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cThe defendants allegedly preyed on unsuspecting victims in this phishing scheme and used their personal information as a gateway to steal millions in their cryptocurrency accounts,\u201d said Akil Davis, the assistant director in charge of the FBI\u2019s Los Angeles field office. \u201cThese types of fraudulent solicitations are ubiquitous and rob American victims of their hard-earned money with the click of a mouse.\u201d<\/p>\n<p>Scattered Spider emanates from an online community known as \u201cthe Com,\u201d an aggressive, nebulous ring of approximately 1,000 young cybercriminals that are mainly organized on online platforms. The group, also tracked by cybersecurity firms as \u201c0ktapus,\u201d Octo Tempest, or UNC3944, has been known to target big-name companies, including the casino giant MGM Resorts and <a href=\"https:\/\/www.bloomberg.com\/news\/articles\/2023-10-04\/clorox-suspected-of-being-hacked-by-same-scattered-spider-group-that-hit-mgm\">Clorox<\/a>.<\/p>\n<p>Court documents reveal that between September 2021 and April 2023, the defendants disseminated mass SMS phishing messages to employees of various target companies. These messages deceptively indicated account deactivation warnings, directing users to phishing sites mirroring genuine business service providers. When employees entered their credentials, these were harvested to gain unauthorized access to corporate systems, resulting in the theft of intellectual property and personal identifiers. The group also used stolen information to break into many cryptocurrency accounts and steal millions of dollars.<\/p>\n<p>The FBI had faced criticism for limited progress in bringing members of the Com to justice. However, law enforcement actions targeting Scattered Spider and the wider Com network have been frequently occurring over the past few months. <\/p>\n<p>Aside from the arrests mentioned above, <a href=\"https:\/\/cyberscoop.com\/mgm-ransomware-attack-arrest-com-uk-police\/\">British police arrested a 17-year-old<\/a> who is believed to be behind last year\u2019s ransomware attack on MGM Resorts. Earlier this month, Canadian <a href=\"https:\/\/cyberscoop.com\/snowflake-breach-suspected-arrested-connor-moucka-waifu\/\">authorities arrested<\/a> Alexander \u201cConnor\u201d Moucka, an alleged Com member suspected of orchestrating a series of data exfiltration attacks targeting customers of the data storage firm Snowflake. <\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"4.1939338235294\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud-1.jpg?w=640&ssl=1\" alt=\"Greg Otto\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Greg Otto<\/h4>\n<p> Greg Otto is Editor-in-Chief of CyberScoop, overseeing all editorial content for the website. Greg has led cybersecurity coverage that has won various awards, including accolades from the Society of Professional Journalists and the American Society of Business Publication Editors. Prior to joining Scoop News Group, Greg worked for the Washington Business Journal, U.S. News & World Report and WTOP Radio. He has a degree in broadcast journalism from Temple University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/federal-charges-scattered-spider-cybercrime-phishing-cryptocurrency-theft\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p> US charges five men linked to \u2018Scattered Spider\u2019 with wire<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,338],"tags":[286,341],"class_list":["post-6336","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-department-of-justice-doj","tag-cybercrime","tag-department-of-justice-doj"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-justice-doj\/\" rel=\"category tag\">Department of Justice (DOJ)<\/a>","tag_info":"Department of Justice (DOJ)","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6336","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6336"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6336\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6336"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6336"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6336"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":6336,"date":"2024-11-20T14:19:38","date_gmt":"2024-11-20T20:19:38","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=82694"},"modified":"2024-11-20T14:19:38","modified_gmt":"2024-11-20T20:19:38","slug":"us-charges-five-men-linked-to-scattered-spider-with-wire-fraud","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/11\/20\/us-charges-five-men-linked-to-scattered-spider-with-wire-fraud\/","title":{"rendered":"\u00a0US charges five men linked to \u2018Scattered Spider\u2019 with wire fraud"},"content":{"rendered":"