Scattered Spider Hacker Gets 10 Years

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, Scattered Spider hacker Noah Michael Urban gets a decade-long prison sentence, new squishing tricks, a pro-Houthi hacker gets 20 months in the United Kingdom, a Taiwanese web hosting provider hacked, Business Council of New York and Ohio Medical Cannabis Center breached, North Korean hackers target Seoul and an Apple Patch.

See Also: On Demand | Global Incident Response Report 2025

An adolescent hacker who was a key member of the Scattered Spider cybercrime collective received Wednesday a 10 year prison sentence from a Jacksonville, Florida federal judge after pleading guilty earlier this year.

Noah Michael Urban, 20, must also pay $13 million in restitution. In a jailhouse interview conducted over the X social media network with independent cybersecurity reporter Brian Krebs, Urban called the sentencing unjust, stating that the judge was upset at him after another Scattered Spider member hacked into a magistrate judge’s email account to steal a copy of Urban’s then-sealed indictment. “Somebody called the outside contractor pretending to be Judge Toomey saying, ‘I need a password change.’ And they gave out the password change,” said U.S. District Judge for the Middle District of Florida Harvey Schlesinger during a January case conference.

The Palm Coast, Florida resident told Krebs his stay in stay in jail following a January 2024 arrest “torture.”

Scattered Spider – also tracked as Roasted 0ktapus and Octo Tempest – famously uses social engineering to obtain initial access to corporate networks. Federal prosecutors in Florida accused Urban of using social engineering to swap the SIM cards of mobile phones in order to intercept one-time passwords sent over SMS (see: Florida Teen Faces Federal Charges in $800,000 Crypto Theft).

Urban, who used online monikers “Sosa,” “Elijah,” Gustavo Fring” and “King Bob,” pleaded guilty in April to one count each of wire fraud conspiracy, wire fraud and aggravated identity theft. He further pleaded guilty to one count of conspiracy in a separate indictment in Los Angeles federal court filed against Urban and four other accused Scattered Spider hackers.

Scattered Spider first emerged in mid-2022 from a cybercrime forum called “The Community,” or “The Com,” and has since been linked to high-profile attacks on more than 130 companies, including MGM Resorts, Clorox and cryptocurrency exchange Coinbase.

Security researchers at Barracuda Networks identified two novel phishing techniques that exploit QR codes, making malicious links harder to detect.

The first method, available in the Gabagool phishing-as-a-service kit, splits a QR code into two images within phishing emails. Security tools scanning the message see harmless image fragments, but recipients view a complete QR code that redirects to a fake Microsoft login page. Barracuda said this approach was spotted in a targeted “password reset” scam likely tied to conversation hijacking.

The second technique, linked to the Tycoon phishing-as-as-service kit, involves nesting a malicious QR code inside a legitimate one. In observed cases, the outer code directed users to a phishing URL while the inner code pointed to Google, creating ambiguity that makes automated detection more difficult.

Barracuda warned that these tactics mark a new wave of “quishing” threats.

A British national received a 20 month prison sentence after pleading guilty earlier this year to nine counts of hacking.

Al-Tahery Al-Mashriky, 26, was a serial hacker of websites who also held the personal data of more than 4 million Facebook users on his laptop when national police arrested him in August 2022, the National Crime Agency said on Saturday. He had stolen credentials for services such as Paypal and Netflix, “which could be used for further acts of cybercrime.”

British authorities honed in on Al-Mashriky after receiving intelligence from U.S. law enforcement agencies investigating the activities of hacktivist groups including the Yemen Cyber Army. U.K. investigators linked him to the group “through social media and email accounts.” The Yemen Cyber Army is a known Iranian cyber proxy and is aligned with the Houthi Shiite Muslim rebels in the ongoing Yemeni Civil War.

Al-Mashriky at one point claimed to have hacked more than 3,000 websites during a three month period in 2022. The National Crime Agency said forensic analysis showed that victims included the Yemen Ministry of Foreign Affairs, the Yemen Ministry of Security Media and news outlet Israeli Live News. “His type of offense centered around gaining unauthorized access to the websites, then creating hidden webpages containing his online monikers and messaging that furthered his religious and political ideology,” police said.

A Chinese state hacking group broke into a Taiwanese web hosting provider in a bid to gain long term access to victim’s VPN and cloud infrastructure, say researchers from Cisco Talos.

The group, tracked by Talos as UAT-7237, targets unpatched servers with known vulnerabilities. The threat intel firm says the group has been active since 2022 and has similarities with a Chinese group specialized in targeting telecom that it tracks as UAT-5918, which overlaps with groups such as Volt Typhoon, as well as Flax Typhoon and Earth Estries. Chinese state hacking groups are known for sharing malware and tactics (see: Chinese Hackers Exploit Unpatched Servers in Taiwan).

UAT-7237 threat activity is distinctive enough from UAT-5918 to merit a separate designation, Talos said. Activity that sets it apart includes heavy reliance on Cobalt Strike to establish backdoors, careful selection of targets for persistence and its use of RDP and SoftEther VPN clients to establish access. Flax Typhoon also uses SoftEther VPN clients to maintain contact with infected machines.

After gaining access, UAT-7237 uses “a variety of customized and open-source tooling to perform a variety of tasks on the infected endpoints,” Talos said. One tool is a custom-built application Talos dubbed “SoundBill,” a shellcode loader written in Chinese. The payload loaded by SoundBill can vary from a customized implementation of the Mimikatz credential extraction tool to an application to arbitrary command execution. “The shellcode may even be a position-independent Cobalt Strike payload that allows UAT-7237 to establish long term access for information stealing.”

The group also uses JuicyPotato, a privilege escalation tool common among Chinese-speaking hackers.

The Business Council of New York State disclosed a data breach that compromised the personal, financial and health information of over 47,000 people. The attack occurred between Feb. 24 and Feb. 25, but was only detected on Aug. 4, nearly six months later.

BCNYS is the state’s largest employer association, representing more than 3,000 organizations – including chambers of commerce, professional groups, trade associations and major corporations that collectively employ more than 1.2 million New Yorkers. The breach affected 47,329 individuals.

An investigation revealed that attackers accessed and exfiltrated files containing a range of sensitive data. Exposed information includes names, Social Security numbers, birth dates, state IDs, banking details, payment card data, taxpayer IDs and electronic signatures. Some files also contained health-related information such as diagnoses, prescriptions, treatment records and insurance details.

Security researcher Jeremiah Fowler spotted a 323 gigabyte database tied to Ohio Medical Alliance – operating as Ohio Marijuana Card – open to the internet and exposing 957,434 sensitive records.

The database contained personal and protected health information, including names, dates of birth, Social Security numbers, home addresses, high-resolution scans of driver’s licenses and IDs. Files were organized in folders labeled with patient names. The database also included intake forms, physician certification forms, mental health evaluations, medical release documents and diagnoses such as anxiety or PTSD.

One file – a CSV named “staff comments” – contained internal notes on patients, appointment details, statuses and over 210,000 email addresses belonging to employees, clients and business partners.

Fowler alerted Ohio Medical Alliance, and the database was restricted from public access the next day.

A North Korean-linked hacking group is running a months-long espionage campaign against foreign embassies in Seoul, posing as diplomats to deliver malware through phishing emails.

Cybersecurity firm Trellix said the operation, active since March and still ongoing, is tied to the Pyongyang-backed group commonly tracked as Kimsuky. The U.S. federal government sanctioned the group in November 2023 for intelligence-gathering. At least 19 embassies and foreign ministries were targeted, with attackers sending emails that mimicked official correspondence, including meeting minutes, ambassadorial letters and event invitations.

The hackers disguised malicious files as PDFs inside password-protected ZIPs, deploying XenoRAT, an open-source remote access Trojan capable of remote control, keystroke logging and webcam surveillance. Once inside, hackers exfiltrate data through GitHub, Dropbox, Google Drive and platforms based in Korea.

The activity aligned with Chinese working hours and paused during Chinese holidays, but not Korean ones, suggesting possible operations from Chinese territory or with Chinese contractors’ involvement. Trellix also observed multilingual decoys in English, Korean, Persian, Arabic, French and Russian.

Apple released an emergency security update to fix a zero-day vulnerability, CVE-2025-43300, actively exploited in targeted attacks. The flaw is found in the Image I/O framework, stems from an out-of-bounds write weakness that could lead to memory corruption, crashes, or remote code execution when processing malicious image files.

Apple said it is aware of reports that the bug was used in an “extremely sophisticated attack” against specific individuals. The company addressed the issue with improved bounds checking and released patches.

The vulnerability affects a wide range of devices, including iPhones, multiple iPad generations and Macs running recent macOS versions. Apple did not disclose details of the attacks or attribute the discovery to a researcher.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey and David Perera in Northern Virginia.