DOJ Charges UK National Linked to Scattered Spider in $115M Cyber Extortion Scheme
Ddos 
The U.S. Department of Justice (DOJ) has unsealed a criminal complaint charging Thalha Jubair, a 19-year-old United Kingdom national, with leading roles in an international cybercrime and extortion campaign attributed to the notorious Scattered Spider group.
According to the complaint, Jubair — known online as “EarthtoStar,” “Brad,” “Austin,” and “@autistic” — conspired to infiltrate U.S. corporate and government networks, steal sensitive data, and extort victims for millions. “From as early as May 2022 to as recently as September 2025, Jubair and his associates were involved in approximately 120 network intrusions, including accessing the computer networks of at least 47 U.S.-based victims,” the DOJ stated. Collectively, victims paid more than $115 million in ransom payments.
Acting Assistant Attorney General Matthew R. Galeotti underscored the scale of the damage: “Jubair is alleged to have participated in a sweeping cyber extortion scheme carried out by a group known as Scattered Spider, which committed at least 120 attacks worldwide and resulted in over $115 million in ransom payments from victims. These malicious attacks caused widespread disruption to U.S. businesses and organizations, including critical infrastructure and the federal court system.”
The complaint alleges Jubair personally targeted a U.S.-based critical infrastructure company and the U.S. Courts between October 2024 and January 2025. Investigators say he and his co-conspirators laundered ransom funds through cryptocurrency wallets, including $36 million seized by law enforcement and another $8.4 million Jubair allegedly transferred to evade seizure.
The indictment ties Jubair to Scattered Spider, also tracked as Octo Tempest, UNC3944, and 0ktapus — an eCrime collective infamous for social engineering campaigns. Jubair and his associates allegedly relied on phishing, SIM-swapping, and fraudulent helpdesk calls to trick employees into handing over credentials. Once inside, they encrypted data, threatened leaks, and demanded multimillion-dollar payouts.
“As alleged by the complaint, Jubair went to great and sophisticated lengths to keep himself anonymous while he and his criminal associates continued to attack these victims and extort tens of millions of dollars in ransom payments,” said Alina Habba, Acting U.S. Attorney for the District of New Jersey. “But thanks to the relentless investigation of this Office and our FBI and CCIPS partners, Jubair could not remain anonymous and avoid justice indefinitely.”
Jubair faces multiple counts, including computer fraud conspiracy, wire fraud conspiracy, money laundering conspiracy, and two counts each of computer fraud and wire fraud. If convicted, he faces a maximum sentence of 95 years in prison.
Related Posts:
- US Enterprises Targeted: Silent Push Unmasks Scattered Spider’s Phishing Web
- Scattered Spider Evolving: New Tactics and Spectre RAT
- Scattered Spider Targets the Cloud: A Growing Threat to the Insurance and Financial Sectors
- Global Cyber Authorities Warn of Escalating Threat from Scattered Spider Group
- BlackCat Ransomware and Beyond: Deciphering Scattered Spider’s Latest TTPs
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
