A 20-year-old Florida man on the heart of a prolific cybercrime group often known as \u201cScattered Spider<\/strong>\u201d was sentenced to 10 years in federal jail at the moment, and ordered to pay roughly $13 million in restitution to victims.<\/p>\n Noah Michael City<\/strong> of Palm Coast, Fla. pleaded responsible in April 2025 to expenses of wire fraud and conspiracy. Florida prosecutors alleged City conspired with others to steal a minimum of $800,000<\/a> from 5 victims through SIM-swapping assaults<\/a> that diverted their cell phone calls and textual content messages to gadgets managed by City and his co-conspirators.<\/p>\n A reserving picture of Noah Michael City launched by the Volusia County Sheriff.<\/p>\n<\/div>\n Though prosecutors had requested for City to serve eight years, Jacksonville information outlet News4Jax.com<\/strong> studies<\/a> the federal choose within the case at the moment opted to condemn City to 120 months in federal jail, ordering him to pay $13 million in restitution and endure three years of supervised launch after his sentence is accomplished.<\/p>\n In November 2024 City was charged by federal prosecutors in Los Angeles<\/a> as certainly one of 5 members of Scattered Spider (a.okay.a. \u201cOktapus,\u201d \u201cScatter Swine\u201d and \u201cUNC3944\u201d), which specialised in SMS and voice phishing assaults that tricked staff at sufferer corporations into coming into their credentials and one-time passcodes at phishing web sites. City pleaded responsible to at least one rely of conspiracy to commit wire fraud within the California case, and the $13 million in restitution is meant to cowl victims from each instances.<\/p>\n The focused SMS scams spanned a number of months throughout the summer time of 2022<\/a>, asking staff to click on a hyperlink and log in at an internet site that mimicked their employer\u2019s Okta authentication web page. Some SMS phishing messages informed staff their VPN credentials had been expiring and wanted to be modified; different missives suggested staff about modifications to their upcoming work schedule.<\/p>\n That phishing spree netted City and others entry to greater than 130 corporations, together with Twilio<\/strong>, LastPass<\/strong>, DoorDash<\/strong>, MailChimp<\/strong>, and Plex<\/strong>. The federal government says the group used that entry to steal proprietary firm information and buyer data, and that members additionally phished folks to steal hundreds of thousands of {dollars} value of cryptocurrency.<\/p>\n For a few years, City\u2019s on-line hacker aliases \u201cKing Bob<\/strong>\u201d and \u201cSosa<\/strong>\u201d had been fixtures of the Com<\/a>, a principally Telegram and Discord-based group of English-speaking cybercriminals whereby hackers boast loudly about high-profile exploits and hacks that nearly invariably start with social engineering. King Bob continuously bragged on the Com about stealing unreleased rap music recordings from common artists, presumably by means of SIM-swapping assaults. Lots of these purloined tracks or \u201cgrails\u201d he later bought or gave away on boards.<\/p>\n Noah \u201cKing Bob\u201d City, posting to Twitter\/X across the time of his sentencing at the moment.<\/p>\n<\/div>\n Sosa additionally was energetic in a very damaging group of achieved legal SIM-swappers often known as \u201cStar Fraud<\/strong>.\u201d Cyberscoop\u2019s AJ Vicens reported in 2023 that people inside Star Fraud had been doubtless concerned within the high-profile Caesars Leisure and MGM Resorts extortion assaults that very same yr.<\/p>\n The Star Fraud SIM-swapping group gained the flexibility to briefly transfer focused cellular numbers to gadgets they managed by continuously phishing staff of the most important cellular suppliers. In February 2023, KrebsOnSecurity revealed information taken from the Telegram channels for Star Fraud and two different SIM-swapping teams displaying these crooks centered on SIM-swapping T-Cell clients, and that they collectively claimed inner entry to T-Cell on 100 separate events over a 7-month interval in 2022<\/a>.<\/p>\n Reached through certainly one of his King Bob accounts on Twitter\/X, City referred to as the sentence unjust, and stated the choose in his case discounted his age as an element.<\/p>\n \u201cThe choose purposefully ignored my age as an element due to the very fact one other Scattered Spider member hacked him personally throughout the course of my case,\u201d City stated in reply to questions, noting that he was sending the messages from a Florida county jail. \u201cHe ought to have been eliminated as a choose a lot earlier on. However staying in county jail is torture.\u201d<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2024\/01\/noahmichaelurban.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/08\/kingbobtweets.png\")
<\/p>\n