Feds Indict 5 Suspects Tied to Scattered Spider Cybercrime

The U.S. government on Wednesday unsealed criminal charges against five suspected members of “a loosely organized, financially motivated cybercriminal group” tied to numerous high-profile and devastating hack attacks.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

An unsealed federal grand jury indictment, filed under seal on Oct. 8, charges the five men with conspiracy, wire fraud and identity theft crimes, committed while operating as part of a hacking group.

“We allege that this group of cybercriminals perpetrated a sophisticated scheme to steal intellectual property and proprietary information worth tens of millions of dollars,” said Martin Estrada, U.S. attorney for the Central District of California, where the case is being prosecuted.

The suspects were allegedly part of the criminal group known as “Scattered Spider,” which has been tied to attacks using “social engineering techniques to target enterprise call centers, extensive SMS phishing campaigns and various other more sophisticated techniques to compromise major organizations,” according to Google Cloud’s Mandiant.

Suspects named in the indictment included Ahmed Hossam Eldin Elbadawy, 23, a.k.a. “AD,” of Texas; Noah Michael Urban, 20, a.k.a. “Sosa” and “Elijah,” of Florida; Evans Onyeaka Osiebo, 20, of Texas; and Joel Martin Evans, 25, a.k.a. “joeleoli,” of North Carolina.

The FBI arrested Evans on Tuesday in North Carolina; Urban was already detained as part of a separate federal case. The government didn’t state whether Elbadawy and Osiebo remain at large. Aside from the indictment, as of Thursday, all other case records remained sealed.

Authorities on Wednesday also unsealed a partially redacted criminal complaint against Tyler Robert Buchanan, a 22-year-old man from Scotland, dated May 25. He’s charged with conspiracy to commit conspiracy, wire fraud and aggravated identity theft.

Spanish police arrested Buchanan on May 31. On June 21, the U.S. Attorney’s Office filed a request for his extradition.

Scattered Spider has been tied to attacks against over 130 different organizations mostly through social engineering. The group has also worked with the Russia-based ransomware group Alphv, a.k.a. BlackCat, oftentimes targeting Western victims.

“These individuals, and other actors that they have collaborated with, have caused so much pain and financial harm to organizations across North America through their disruptive intrusions,” said Charles Carmakal, CTO of Google Cloud’s Mandiant.

“This is a nice win for law enforcement that over time has significantly hampered the group’s fast-paced tempo this year,” Carmakal said.

FBI Ties Suspects to at Least 45 Attacks

The FBI said it has tied these five suspects to the targeting of at least 45 companies based in the U.S. and abroad, including Canada, the U.K. and India. The group’s victims or attempted victims included “dozens of companies” in the U.S. spanning numerous sectors, including social media, venture capital, interactive entertainment, telecommunications and technology, consultancies, cloud providers, and virtual currency, according to court documents.

The defendants have also been charged with stealing virtual currency worth at least $11 million from 29 victims.

The suspects have been charged with running phishing attacks from at least Sept. 2021 to April 2023, oftentimes sending mass SMS text messages to employees of targeted firms. The messages typically purported to be from the company, or else a trusted IT or business supplier, and “often stated that the employees’ accounts were about to be deactivated and provided links to phishing websites that were designed to look like legitimate websites of the victim companies or their contracted suppliers and lure the recipient into providing confidential information, including account login credentials,” said the Department of Justice.

The FBI said the attackers’ phishing toolkits included the ability to trick victims into not just entering their username and password but any one-time code they might receive as part of a two-factor authentication request.

Prosecutors have accused the suspects of using the stolen authentication information to access victims’ networks and “confidential information, including confidential work product, intellectual property and personal identifying information, such as account access credentials, names, email addresses and telephone numbers.”

The group allegedly also used information – leaked sets of data and other sources – obtained through these intrusions “to gain unauthorized access to numerous individuals’ cryptocurrency accounts and wallets and steal millions of dollars’ worth of virtual currency,” the DOJ said.

Scotland Seized Suspect’s Devices

While prosecutors need not detail in full in an indictment all of their evidence pertaining to a case, a U.S. extradition request filed with Spain contains extra details about evidence gathered in the course of a separate Scottish law enforcement investigation.

The extradition request said Police Scotland in April 2023 searched Buchanan’s residence in Dundee, seizing around 20 digital devices – including desktop and laptop computers, external storage devices, and phone – and shared digital forensic copies of them with the FBI, from Nov. 2023 to Jan. 2024.

In the browser search history of devices seized by Police Scotland, the FBI said it found multiple visits to phishing service management consoles, attempts to log into victim companies, usernames and passwords for employees of U.S. firms, and messages, including screenshots of Telegram chats, referencing “SIM-swapping and social engineering” schemes used to harvest cryptocurrency worth at least $3 million from victims.

The bureau said one of the systems seized from Buchanan contained a phishing kit, described as being “a software program designed to capture information coming into a phishing website (such as usernames and passwords) and then transmitted that information to another database that could be accessed by attackers.” Investigators said they believe that the Telegram channel was accessed by an unnamed coconspirator.

The installed phishing kit had the same hash value as the phishing kits hosted on virtual private servers used to launch the phishing attacks, it said.

The FBI said a blockchain “shortcut” found on Buchanan’s system referenced a cryptocurrency address – which it believes he controlled – via which 391 bitcoins, currently worth $30 million, were transferred in or out from Oct. 2022 to Feb. 2023.