Alleged Scattered Spider Hacker Extradited to the US
Alleged Scattered Spider hacker extradited to the US after a cyberattack on a high-end jewelry retailer.
Extradition of Peter Stokes
A dual US-Estonian citizen, Peter Stokes, 19, was extradited to the United States to face charges linked to the Scattered Spider cybercriminal collective. Stokes, who operates under the alias ‘Bouquet,’ was detained in Finland in April while attempting to board a flight to Japan. He is charged with conspiracy, unauthorized access to computer systems, and fraud.
Key Details
In May 2025, Stokes reportedly participated in a cyberattack targeting a high-end jewelry retailer’s digital infrastructure. The breach involved unauthorized data extraction, followed by a demand for an $8 million cryptocurrency ransom. Although the retailer removed the threat actors and declined to pay the ransom, the incident caused operational disruptions and additional costs of at least $2 million.
Scattered Spider’s Activities
Scattered Spider, also known as 0ktapus, Muddled Libra, and other monikers, has been linked to at least 100 organizational breaches. The group is estimated to have collected over $100 million in ransom payments. Notable campaigns include a 2025 attack on Salesforce systems and the 0ktapus operation, which affected over 130 entities in 2022.
Notable Campaigns
The group publicly announced its dissolution in 2025 following a series of high-profile attacks targeting retail, insurance, and aviation sectors. Law enforcement actions against the group have intensified, including the recent guilty plea of a UK national, Tyler Robert Buchanan, in a U.S. court.
Other Cybersecurity Developments
Recent developments include the sentencing of a third individual involved in a DraftKings breach, the arrest of administrators of a hosting service linked to Russian cybercriminals in the Netherlands, and the detention of a Canadian suspect associated with the Kimwolf botnet. A Karakurt ransomware group negotiator also received a prison sentence.
Technical Advisories
Active exploitation of vulnerabilities in Cisco Unified CM, Microsoft SharePoint, and Citrix NetScaler has been reported. Patches address critical flaws in Adobe ColdFusion, Campaign Classic, and Apple’s iOS, macOS, and Safari platforms. New threats include vulnerabilities in CitrixBleed, HTTP/2 Bomb, and the Cursor AI code editor.
Industry Updates
Funding for a security architecture automation platform, regulatory changes impacting AI model access, and challenges in auditing AI-driven software development have emerged. Security experts emphasize the need for enterprises to critically evaluate AI capabilities and manage rising costs of agentic AI systems.
Ongoing Threats and Collaborations
Cybercriminal groups like ShinyHunters have inflicted damage without relying on traditional malware or zero-day exploits. Law enforcement and private sector collaboration has disrupted networks such as NetNut, which used compromised devices for residential proxy services. The cybersecurity community continues to monitor evolving threats and strengthen defenses against ransomware and data breaches.
Conclusion
The extradition of Peter Stokes and ongoing efforts to combat Scattered Spider highlight the global fight against cybercrime. As threats evolve, collaboration between law enforcement, private sector entities, and cybersecurity experts remains critical to mitigating risks and protecting digital infrastructure.
About Author
English