Teen arrested in UK was a core figure in Scattered Spider\u2019s operations | CyberScoop<\/title> <meta name=\"description\" content=\"Researchers said Thalha Jubair was a principal operator, leading or directing many attacks attributed to the hacker subset of The Com since 2022.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/thalha-jubair-uk-teen-scattered-spider-leader\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Teen arrested in UK was a core figure in Scattered Spider\u2019s operations\"> <meta property=\"og:description\" content=\"Researchers said Thalha Jubair was a principal operator, leading or directing many attacks attributed to the hacker subset of The Com since 2022.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/thalha-jubair-uk-teen-scattered-spider-leader\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2025-09-24T14:28:37+00:00\"> <meta property=\"article:modified_time\" content=\"2025-09-24T14:28:40+00:00\"> <meta name=\"author\" content=\"Matt Kapko\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg\"> <meta name=\"twitter:creator\" content=\"@CyberScoopNews\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1754500264g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1757443701g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1753281318g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=13897d660a0ac2c9c7d1\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/86117\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.2\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=86117\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fthalha-jubair-uk-teen-scattered-spider-leader%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fthalha-jubair-uk-teen-scattered-spider-leader%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-86117 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/thalha-jubair-uk-teen-scattered-spider-leader\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.932806324111\">\n<div class=\"single-article__header-content\" readability=\"35.221153846154\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/thalha-jubair-uk-teen-scattered-spider-leader\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> Researchers said Thalha Jubair was a principal operator, leading or directing many attacks attributed to the hacker subset of The Com since 2022. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/86117\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt=\"A spider hangs from the railing of a pedestrian bridge. (Moritz Frankenberg\/Getty Images)\" decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg 3903w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=2048,1365 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> A spider hangs from the railing of a pedestrian bridge. (Moritz Frankenberg\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"76.507460366801\"><body readability=\"155.38798920378\"><\/p>\n<p>The 19-year-old U.K. national who was <a href=\"https:\/\/cyberscoop.com\/scattered-spider-teenagers-arrested-uk\/\">arrested at his London residence<\/a> last week was a highly prolific cybercriminal and a core member of the nebulous hacker subset of <a href=\"https:\/\/cyberscoop.com\/fbi-warning-the-com-cybercrime-extortion-violence\/\">The Com<\/a>, researchers told CyberScoop.<\/p>\n<p>Authorities\u2019 yearslong quest to uncover the identities of <a href=\"https:\/\/cyberscoop.com\/scattered-spider-social-engineering-cybercrime\/\">Scattered Spider<\/a> associates and charge them with serious crimes reached a tipping point with last week\u2019s arrest of Thalha Jubair, who is accused of direct, prominent involvement in at least 120 cyberattacks, including extortion of 47 U.S.-based organizations and the January attack on the U.S. federal court system. <\/p>\n<p>Authorities said they traced a combined total of at least $89.5 million in cryptocurrency, at the time of payments, to Bitcoin addresses and servers controlled by Jubair. Two financial services firms paid Jubair $25 million and $36.2 million, respectively, in Bitcoin between June and November 2023, according to an <a href=\"https:\/\/www.justice.gov\/usao-nj\/media\/1414461\/dl?inline\">unsealed criminal complaint<\/a> against Jubair. <\/p>\n<p>The high number of attacks and ransom payments officials linked to Jubair highlights the central role he played in attacks more broadly attributed to Scattered Spider. Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, said Jubair was one of the principal operators behind the loose-knit cybercrime network. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cHe was one of the four principal people that we associated with Scattered Spider,\u201d and one of the two most core players, Meyers told CyberScoop. <\/p>\n<p>Other cybercrime experts shared similar assessments of Jubair\u2019s involvement and importance to Scattered Spider\u2019s sweeping extortion scheme. While The Com, of which Scattered Spider is an offshoot, doesn\u2019t operate with formal leaders in the traditional sense, Jubair acted as a leader, said Jon DiMaggio, chief security strategist at Analyst1.<\/p>\n<p>\u201cThere are many other pockets of activity within the broader collective, and I would consider Jubair a leader within several of the clusters he supported and influenced,\u201d DiMaggio said. <\/p>\n<p>Flashpoint analysts described Jubair as a large player within these communities who participated in attacks against multiple sectors for years. \u201cTheir growth and evolution appear consistent with the growth and scale of attacks ascribed to Scattered Spider,\u201d analysts at the threat intelligence company said in an email.<\/p>\n<p>Federal authorities attribute Scattered Spider to attacks on organizations in many sectors, including manufacturing, entertainment, retail, aviation, insurance, finance, business process and customer service outsourcing, construction, hospitality, technology, telecommunications and multiple forms of critical infrastructure. Victims of those attacks paid at least $115 million in ransom payments, authorities said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cThey were cleaning up, and this is just the amount the FBI knows about,\u201d Sherrod DeGrippo, director of threat intelligence strategy at Microsoft, said in a <a href=\"https:\/\/www.linkedin.com\/posts\/sherroddegrippo_ok-i-read-the-latest-octo-tempest-aka-scattered-activity-7375979316993601536--lhM\/\">post on LinkedIn<\/a>.<\/p>\n<p>Researchers knew the identity of Jubair, who went by many aliases online including \u201cEarthtoStar,\u201d \u201cBrad,\u201d \u201cAustin,\u201d \u201cEverylynn\u201d and \u201c@autistic,\u201d for more than a year. He was on their radar, and even more so after law enforcement seized cryptocurrency worth about $36 million at the time on wallets stored on a server allegedly controlled by Jubair in July 2024. <\/p>\n<p>\u201cIt did take several years and they had quite a run when everybody was paying attention to them,\u201d Meyers said. Officials \u201cknew who he was a year ago. I think what it highlights is that they needed a way to be able to make a case, which is where law enforcement, frankly, ends up at a bit of a disadvantage.\u201d<\/p>\n<p>Investigators bolstered their case against Jubair through blockchain analysis. Officials said they traced cryptocurrency transactions from a wallet on a server Jubair controlled to gift card purchases that were used for a food delivery service to his apartment complex and a gaming account. <\/p>\n<p>\u201cHis arrest underscores the difficulties in remaining anonymous online,\u201d Flashpoint analysts said. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>While Jubair was \u201cextremely careful,\u201d using an amnesiatic operating system \u2014 which is designed to forget everything a user does after it\u2019s shut down \u2014 and virtual private networks, according to Meyers, his personal activity led investigators to his doorstep.<\/p>\n<p>Jubair faces charges in the United Kingdom and United States. U.K. authorities last week charged him for crimes related to the cyberattack on the Transport for London in September 2024. He was also charged in the U.S. District Court for the District of New Jersey with computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy.<\/p>\n<p>The Justice Department hasn\u2019t said if efforts are underway to extradite Jubair to the United States, where he faces up to 95 years in prison if convicted.<\/p>\n<p>While veteran threat hunters hail Jubair\u2019s arrest, they remain exasperated by the persistent challenges and delays that were highlighted by a case involving a known and allegedly highly prolific cybercriminal. <\/p>\n<p>\u201cIt took a long time. There\u2019s still a lot of frustration in how long it took, and how much information we had on these guys and the way that the investigation went down,\u201d Meyers said. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Nonetheless, Jubair\u2019s \u201carrest is a big deal, maybe one of the biggest in this circle,\u201d DiMaggio said. <\/p>\n<p>\u201cGiven Jubair\u2019s alleged involvement across many operations and aliases, removing him likely hurts how things are done in multiple criminal clusters. It might force others to change how they operate or slow some attacks,\u201d he added. <\/p>\n<p>\u201cBut because the group is spread out and loosely organized, I don\u2019t think this one arrest stops things entirely,\u201d DiMaggio said. Jubair\u2019s arrest is \u201cvery impactful, and among the most important arrests in The Com so far, but we shouldn\u2019t assume it\u2019s a knockout blow.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.5643564356436\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations-1.jpg?w=640&ssl=1\" alt=\"Matt Kapko\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Matt Kapko<\/h4>\n<p> Matt Kapko is a reporter at CyberScoop. His beat includes cybercrime, ransomware, software defects and vulnerability (mis)management. The lifelong Californian started his journalism career in 2001 with previous stops at Cybersecurity Dive, CIO, SDxCentral and RCR Wireless News. Matt has a degree in journalism and history from Humboldt State University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/thalha-jubair-uk-teen-scattered-spider-leader\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Teen arrested in UK was a core figure in Scattered<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[5073,4415,282,78,338,3911,625,46,256,953,984,3679],"tags":[5074,4416,286,86,341,3915,630,54,262,958,986,3682],"class_list":["post-8010","post","type-post","status-publish","format-standard","hentry","category-analyst1","category-arrest","category-cybercrime","category-cybersecurity","category-department-of-justice-doj","category-flashpoint","category-microsoft","category-ransomware","category-research","category-scattered-spider","category-the-com","category-uk","tag-analyst1","tag-arrest","tag-cybercrime","tag-cybersecurity","tag-department-of-justice-doj","tag-flashpoint","tag-microsoft","tag-ransomware","tag-research","tag-scattered-spider","tag-the-com","tag-uk"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/analyst1\/\" rel=\"category tag\">Analyst1<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/arrest\/\" rel=\"category tag\">Arrest<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/department-of-justice-doj\/\" rel=\"category tag\">Department of Justice (DOJ)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/flashpoint\/\" rel=\"category tag\">Flashpoint<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/microsoft\/\" rel=\"category tag\">Microsoft<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/research\/\" rel=\"category tag\">Research<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/scattered-spider\/\" rel=\"category tag\">Scattered Spider<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/the-com\/\" rel=\"category tag\">The Com<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/uk\/\" rel=\"category tag\">UK<\/a>","tag_info":"UK","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8010","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8010"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8010\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8010,"date":"2025-09-24T09:28:37","date_gmt":"2025-09-24T14:28:37","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=86117"},"modified":"2025-09-24T09:28:37","modified_gmt":"2025-09-24T14:28:37","slug":"teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/09\/24\/teen-arrested-in-uk-was-a-core-figure-in-scattered-spiders-operations\/","title":{"rendered":"Teen arrested in UK was a core figure in Scattered Spider\u2019s operations"},"content":{"rendered":"