Teenage Scattered Spider Suspect Arrested in Las Vegas

The net continues to close on suspected members of the notorious ransomware-wielding group called Scattered Spider.

See Also: Top 10 Technical Predictions for 2025

The Las Vegas Metropolitan Police Department said it has in custody a male teenager, wanted in connection with attacks on local casinos.

“The juvenile suspect surrendered himself to the Clark County Juvenile Detention Center,” where police booked him Wednesday on charges of extortion, conspiracy, computer crime and using another person’s personally identifiable information to harm or impersonate them, police said.

The juvenile court system in Nevada applies to suspects who are 18 years of age or younger, or who are suspected of committing a crime before they turned 18 and are still less than 21 years of age, said legal experts.

Detectives identified the suspect as part of an ongoing investigation being led by the FBI’s Las Vegas Cyber Task Force, with assistance from the metropolitan police.

The suspect’s arrest came two years after hackers hit Vegas casino giants MGM Resorts and Caesars Entertainment. Hackers reportedly demanded $30 million in cryptocurrency from Caesars and the gaming giant paid them half to avoid experiencing any significant downtime. MGM refused to pay, and faced weeks of outages, leading to $110 million in lost revenue and cyberattack mitigation expenses.

Cybersecurity experts traced both of those attacks to Scattered Spider – a codename first assigned to the group by CrowdStrike to reflect the collective’s scattershot approach to hacking victims, often organized over Telegram or Discord channels. The group is also known as Octo Tempest, Muddled Libra, UNC3944 and 0ktapus. For the casino attacks, the attackers – calling themselves Star Fraud – boasted that they’d tricked an IT help desk into resetting a password, leading to them gaining initial access.

Scattered Spider grew out of a cybercrime collective known as The Com, formed by 2022. Experts say it’s largely comprised of U.S. and British teenagers – often, native English speakers – who excel at social engineering, phishing and SIM swapping, regularly engage in sextortion attacks, and combine data theft and extortion with ransomware.

If the hackers targeted or breached any other casino operators’ networks in the summer of 2023, that information hasn’t been made public. The group, described by cybersecurity experts as being both methodical as well as flexible, regularly focuses its attacks on a specific sector. This past summer, the focus included British retailers, followed by the aviation industry and American insurers.

The arrest last week in Las Vegas follows British law enforcement agents arresting Thalha Jubair, 19, and Owen Flowers, 18, in England on charges tied to disrupting London’s transportation network in 2024, as well as being members of Scattered Spider. The U.S. Department of Justice unsealed an indictment charging Jubair with being part of Scattered Spider and participating in attacks from May 2022 through to this month that amassed over 100 victims, who collectively paid ransoms worth at least $115 million (see: Scattered Spider Sting: 2 English Teens Charged With Attacks).

Whether these arrests might finally stymie the hacking group attacks remains to be seen. U.S. prosecutors last November unsealed an indictment charging five men – including two each in Texas and one each in Florida and North Carolina – for perpetrating Scattered Spider attacks that generated at least $27 million in cryptocurrency ransom payments. Spanish police arrested the fifth suspect, Scottish national Tyler Robert Buchanan, in May 2024 and he was extradited to the United States in April.

Britain’s National Crime Agency arrested in July a 19-year-old Latvian male, two males aged 17 and 19, as well as a 20-year-old woman, as part of their probe into Scattered Spider attacks against British retailers M&S, the Co-op and Harrods. None of those suspects were named.

Scattered Spider said it’s lately been operating closely with Com spinoff ShinyHunters, which specializes in data theft and extortion, under the name “Shiny Lapsus$ Hunters.” The group claimed credit for the Sept. 1 disruption of luxury British carmaker Jaguar Land Rover’s operations, which continues to keep production lines offline and is causing ongoing supply chain chaos.

At least one member of the group earlier this month claimed they’d retired from that hacking life, but that assertion appears to have been bogus (see: Scattered Spider Tied to Fresh Attacks on Financial Services).