U.S. prosecutors final week levied prison hacking costs in opposition to 19-year-old U.Ok. nationwide Thalha Jubair<\/strong> for allegedly being a core member of Scattered Spider<\/strong>, a prolific cybercrime group blamed for extorting at the very least $115 million in ransom funds from victims. The fees got here as Jubair and an alleged co-conspirator appeared in a London court docket to face accusations of hacking into and extorting a number of massive U.Ok. retailers, the London transit system, and healthcare suppliers in america.<\/p>\n At a court docket listening to final week, U.Ok. prosecutors laid out a litany of costs in opposition to Jubair and 18-year-old Owen Flowers<\/strong>, accusing the kids of involvement in an August 2024 cyberattack that crippled Transport for London<\/strong>, the entity chargeable for the general public transport community within the Better London space.<\/p>\n A court docket artist sketch of Owen Flowers (left) and Thalha Jubair showing at Westminster Magistrates\u2019 Courtroom final week. Credit score: Elizabeth Prepare dinner, PA Wire.<\/p>\n<\/div>\n On July 10, 2025, KrebsOnSecurity reported<\/a> that Flowers and Jubair had been arrested in the UK in reference to latest Scattered Spider ransom assaults<\/a> in opposition to the retailers Marks & Spencer<\/strong> and Harrods<\/strong>, and the British meals retailer Co-op Group<\/strong>.<\/p>\n That story cited sources near the investigation saying Flowers was the Scattered Spider member who anonymously gave interviews to the media within the days after the group\u2019s September 2023 ransomware assaults disrupted operations at Las Vegas casinos operated by MGM Resorts<\/strong> and Caesars Leisure<\/strong>.<\/p>\n The story additionally famous that Jubair\u2019s alleged handles on cybercrime-focused Telegram channels had far lengthier rap sheets involving a number of the extra consequential and headline-grabbing information breaches over the previous 4 years. What follows is an account of cybercrime actions that prosecutors have attributed to Jubair\u2019s alleged hacker handles, as informed by these accounts in posts to public Telegram channels which can be carefully monitored by a number of cyber intelligence corporations.<\/p>\n Jubair is alleged to have been a core member of the LAPSUS$<\/strong>\u00a0cybercrime group that\u00a0broke into dozens of know-how corporations starting in late 2021<\/a>, stealing supply code and different inside information from tech giants together with\u00a0Microsoft<\/strong>,\u00a0Nvidia<\/strong>,\u00a0Okta<\/strong>,\u00a0Rockstar Video games<\/strong>,\u00a0Samsung<\/strong>,\u00a0T-Cellular<\/strong>, and\u00a0Uber<\/strong>.<\/p>\n That’s, in line with the previous chief of the now-defunct LAPSUS$. In April 2022, KrebsOnSecurity printed inside chat data<\/a> taken from a server that LAPSUS$ used, and people chats point out Jubair was working with the group utilizing the nicknames Amtrak<\/strong>\u00a0and\u00a0Asyntax<\/strong>. In the course of the gang\u2019s cybercrime spree, Asyntax informed the LAPSUS$ chief to not share T-Cellular\u2019s emblem in photographs despatched to the group as a result of he\u2019d been beforehand busted for SIM-swapping and his dad and mom would suspect he was again at it once more.<\/p>\n The chief of LAPSUS$ responded by gleefully posting Asyntax\u2019s actual identify, cellphone quantity, and different hacker handles right into a public chat room on Telegram:<\/p>\n In March 2022, the chief of the LAPSUS$ information extortion group uncovered Thalha Jubair\u2019s identify and hacker handles in a public chat room on Telegram.<\/p>\n<\/div>\n<\/div>\n That story in regards to the leaked LAPSUS$ chats additionally related Amtrak\/Asyntax to a number of earlier hacker identities, together with \u201cEverlynn<\/strong>,\u201d who in April 2021 started providing a cybercriminal service that offered fraudulent \u201cemergency information requests\u201d<\/a>\u00a0concentrating on the key social media and e mail suppliers.<\/p>\n In these so-called \u201cfaux EDR\u201d schemes, the hackers compromise e mail accounts tied to police departments and authorities companies, after which ship unauthorized calls for for subscriber information (e.g. username, IP\/e mail deal with), whereas claiming the data being requested can\u2019t look ahead to a court docket order as a result of it pertains to an pressing matter of life and loss of life.<\/p>\n The roster of the now-defunct \u201cInfinity Recursion\u201d hacking workforce, which offered faux EDRs between 2021 and 2022. The founder \u201cEverlynn\u201d has been tied to Jubair. The member listed as \u201cPeter\u201d turned the chief of LAPSUS$ who would later put up Jubair\u2019s identify, cellphone quantity and hacker handles into LAPSUS$\u2019s chat channel.<\/p>\n<\/div>\n Prosecutors in New Jersey final week alleged<\/a> Jubair was a part of a menace group variously often called Scattered Spider, 0ktapus<\/strong>, and UNC3944<\/strong>, and that he used the nicknames EarthtoStar<\/strong>, Brad<\/strong>, Austin<\/strong>, and Austistic<\/strong>.<\/p>\n Starting in 2022, EarthtoStar co-ran a bustling Telegram channel referred to as Star Chat<\/strong>, which was house to a prolific SIM-swapping group that relentlessly used voice- and SMS-based phishing assaults to steal credentials from workers on the main wi-fi suppliers within the U.S. and U.Ok.<\/p>\n Jubair allegedly used the deal with \u201cEarth2Star,\u201d a core member of a prolific SIM-swapping group working in 2022. This advert produced by the group lists numerous costs for SIM swaps.<\/p>\n<\/div>\n The group would then use that entry to promote a SIM-swapping service that might redirect a goal\u2019s cellphone quantity to a tool the attackers managed, permitting them to intercept the sufferer\u2019s cellphone calls and textual content messages (together with one-time codes). Members of Star Chat focused a number of wi-fi carriers with SIM-swapping assaults, however they targeted primarily on phishing T-Cellular workers.<\/p>\n In February 2023, KrebsOnSecurity scrutinized greater than seven months of those SIM-swapping solicitations on Star Chat, which nearly each day peppered the general public channel with \u201cTmo up!\u201d and \u201cTmo down!\u201d notices indicating intervals whereby the group claimed to have energetic entry to T-Cellular\u2019s community.<\/p>\n A redacted receipt from Star Chat\u2019s SIM-swapping service concentrating on a T-Cellular buyer after the group gained entry to inside T-Cellular worker instruments.<\/p>\n<\/div>\n The info confirmed that Star Chat \u2014 together with two different SIM-swapping teams working on the similar time \u2014 collectively broke into T-Cellular over 100 instances within the final seven months of 2022<\/a>. Nevertheless, Star Chat was by far essentially the most prolific of the three, chargeable for at the very least 70 of these incidents.<\/p>\n The 104 days within the latter half of 2022 through which completely different identified SIM-swapping teams claimed entry to T-Cellular worker instruments. Star Chat was chargeable for a majority of those incidents. Picture: krebsonsecurity.com.<\/p>\n<\/div>\n A evaluate of EarthtoStar\u2019s messages on Star Chat as listed by the menace intelligence agency Flashpoint<\/strong> exhibits this particular person additionally offered \u201cAT&T e mail resets\u201d and AT&T name forwarding companies for as much as $1,200 per line. EarthtoStar defined the aim of this service in put up on Telegram:<\/p>\n \u201cOkay persons are confused, so you already know when u login to chase and it says \u20182fa required\u2019 or regardless of the fuck, nicely it offers you two choices, SMS or Name. For those who press name, and I ahead the road to you then who do you suppose will get mentioned name?\u201d<\/p>\n<\/blockquote>\n New Jersey prosecutors allege Jubair additionally was concerned in a mass SMS phishing marketing campaign throughout the summer season of 2022<\/a> that stole single sign-on credentials from workers at a whole bunch of corporations. The textual content messages requested customers to click on a hyperlink and log in at a phishing web page that mimicked their employer\u2019s Okta<\/strong> authentication web page, saying recipients wanted to evaluate pending adjustments to their upcoming work schedules.<\/p>\n The phishing web sites used a Telegram on the spot message bot to ahead any submitted credentials in real-time, permitting the attackers to make use of the phished username, password and one-time code to log in as that worker at the true employer web site.<\/p>\n That weeks-long SMS phishing marketing campaign led to intrusions and information thefts at greater than 130 organizations, together with LastPass<\/strong>, DoorDash<\/strong>, Mailchimp<\/strong>, Plex<\/strong> and Sign<\/strong>.<\/p>\n A visible depiction of the assaults by the SMS phishing group often called 0ktapus, ScatterSwine, and Scattered Spider. Picture: Amitai Cohen twitter.com\/amitaico.<\/p>\n<\/div>\n EarthtoStar\u2019s group Star Chat specialised in phishing their method into enterprise course of outsourcing (BPO) corporations that present buyer help for a variety of multinational corporations, together with a variety of the world\u2019s largest telecommunications suppliers. In Might 2022, EarthtoStar posted to the Telegram channel \u201cFrauwudchat\u201d:<\/p>\n \u201cHello, I’m searching for companions in an effort to exfiltrate information from massive telecommunications corporations\/name facilities\/alike, I’ve main expertise on this discipline, [including] an enormous name heart which homes 200,000+ workers the place I’ve dumped all consumer credentials and gained entry to the [domain controller] + obtained world administrator I even have expertise with REST API\u2019s and programming. I’ve in depth expertise with VPN, Citrix, cisco anyconnect, social engineering + privilege escalation. You probably have any Citrix\/Cisco VPN or some other helpful issues please message me and lets work.\u201d<\/p>\n<\/blockquote>\n At across the similar time within the Summer time of 2022, at the very least two completely different accounts tied to Star Chat \u2014 \u201cRocketAce<\/strong>\u201d and \u201cLopiu<\/strong>\u201d \u2014 launched the group\u2019s companies to denizens of the Russian-language cybercrime discussion board Exploit<\/strong>, together with:<\/p>\n -SIM-swapping companies concentrating on Verizon and T-Cellular clients; The consumer \u201cLopiu\u201d on the Russian cybercrime discussion board Exploit marketed most of the similar distinctive companies supplied by EarthtoStar and different Star Chat members. Picture supply: ke-la.com.<\/p>\n<\/div>\n These two accounts on Exploit created a number of gross sales threads through which they claimed administrative entry to U.S. telecommunications suppliers and requested different Exploit members for assist in monetizing that entry. In June 2022, RocketAce, which seems to have been simply one among EarthtoStar\u2019s many aliases, posted to Exploit:<\/p>\n Hey. I’ve entry to a telecommunications firm\u2019s citrix and vpn. I would love somebody to assist me escape of the system and doubtlessly assault the area controller so all logins could be extracted we will focus on cost and issues depart your telegram within the feedback or non-public message me ! In search of somebody with data in citrix\/privilege escalation<\/p>\n<\/blockquote>\n On Nov. 15, 2022, EarthtoStar posted to their Star Sanctuary<\/strong> Telegram channel that they had been hiring malware builders with a minimal of three years of expertise and the flexibility to develop rootkits, backdoors and malware loaders.<\/p>\n \u201cNon-obligatory: Endorsed by superior APT Teams (e.g. Conti, Ryuk),\u201d the advert concluded, referencing two of Russia\u2019s most rapacious and harmful ransomware affiliate operations. \u201cA part of a nation-state \/ ex-3l (3 letter-agency).\u201d<\/p>\n The Telegram and Discord chat channels whereby Flowers and Jubair allegedly deliberate and executed their extortion assaults are a part of a loose-knit community often called the Com<\/strong>, an English-speaking cybercrime neighborhood consisting principally of people dwelling in america, the UK, Canada and Australia.<\/p>\n Many of those Com chat servers have a whole bunch to 1000’s of members every, and a number of the extra fascinating solicitations on these communities are job provides for in-person assignments and duties that may be discovered if one searches for posts titled, \u201cFor those who reside close to,\u201d or \u201cIRL job\u201d \u2014 quick for \u201cin actual life\u201d job.<\/p>\n These \u201cviolence-as-a-service<\/a>\u201d solicitations usually contain \u201cbrickings,\u201d the place somebody is employed to toss a brick by means of the window at a specified deal with. Different IRL jobs for rent embody tire-stabbings, molotov cocktail hurlings, drive-by shootings, and even house invasions. The individuals focused by these companies are usually different criminals inside the neighborhood, but it surely\u2019s commonplace to see Com members asking others for assist in harassing or intimidating safety researchers and even the very regulation enforcement officers who’re investigating their alleged crimes.<\/p>\n It stays unclear what precipitated this incident or what adopted instantly after, however on January 13, 2023, a Star Sanctuary account utilized by EarthtoStar solicited the house invasion of a sitting U.S. federal prosecutor from New York. That put up included a photograph of the prosecutor taken from the Justice Division\u2019s web site, together with the message:<\/p>\n \u201cWant irl niggas, in house hostage shit no fucking pussies no skinny glock holding 100 pound niggas both\u201d<\/p>\n<\/blockquote>\n All through late 2022 and early 2023, EarthtoStar\u2019s alias \u201cBrad\u201d (a.okay.a. \u201cBrad_banned\u201d) ceaselessly marketed Star Chat\u2019s malware growth companies, together with customized malicious software program designed to cover the attacker\u2019s presence on a sufferer machine:<\/p>\n We will develop KERNEL malware which is able to obtain persistence for a very long time, This shit is actually like STAGE 4 CANCER FOR COMPUTERS!!!<\/p>\n Kernel that means the very best degree of authority on a machine. Bypass all main EDR\u2019s (SentinelOne, CrowdStrike, and so on) As soon as implanted, extraordinarily troublesome to take away (principally not possible to even discover) Be one step forward of the sport. Costs begin from $5,000+. Message @brad_banned to get a quote<\/p>\n<\/blockquote>\n In September 2023 , each MGM Resorts and Caesars Leisure suffered ransomware assaults by the hands of a Russian ransomware associates program often called ALPHV<\/strong> and BlackCat<\/strong>. Caesars reportedly paid a $15 million ransom<\/a> in that incident.<\/p>\n Inside hours of MGM publicly acknowledging the 2023 breach, members of Scattered Spider had been claiming credit score and telling reporters they\u2019d damaged in by social engineering a third-party IT vendor. At a listening to in London final week, U.Ok. prosecutors informed the court docket Jubair was present in possession of greater than $50 million in ill-gotten cryptocurrency, together with funds that had been linked to the Las Vegas on line casino hacks.<\/p>\n The Star Chat channel was lastly banned by Telegram on March 9, 2025. However U.S. prosecutors say Jubair and fellow Scattered Spider members continued their hacking, phishing and extortion actions up till September 2025.<\/p>\n In April 2025, the Com was buzzing in regards to the publication of \u201cThe Com Solid<\/strong>,\u201d a prolonged screed detailing Jubair\u2019s alleged cybercriminal actions and nicknames through the years. This account included pictures and voice recordings allegedly of Jubair, and asserted that in his early days on the Com Jubair used the nicknames Clark and Miku (these are each aliases utilized by Everlynn in reference to their faux EDR companies).<\/p>\n Thalha Jubair (proper), with out his large-rimmed glasses, in an undated picture posted in The Com Solid.<\/p>\n<\/div>\n Extra not too long ago, the nameless Com Solid writer(s) claimed, Jubair had used the nickname \u201cOperator,\u201d which corresponds to a Com member who ran an automatic Telegram-based doxing service that pulled shopper data from hacked information dealer accounts. That public outing got here after Operator allegedly seized management over the Doxbin<\/strong>, a long-running and extremely poisonous neighborhood that’s used to \u201cdox\u201d or put up deeply private info on individuals.<\/p>\n \u201cOperator\/Clark\/Miku: A key member of the ransomware group Scattered Spider, which consists of a various combine of people concerned in SIM swapping and phishing,\u201d the Com Solid account acknowledged. \u201cThe group is an amalgamation of a number of key organizations, together with Infinity Recursion (owned by Operator), True Alcorians (owned by earth2star), and Lapsus, which have come collectively to type a single collective.\u201d<\/p>\n The New Jersey criticism<\/a> (PDF) alleges Jubair and different Scattered Spider members dedicated laptop fraud, wire fraud, and cash laundering in relation to at the very least 120 laptop community intrusions involving 47 U.S. entities between Might 2022 and September 2025. The criticism alleges the group\u2019s victims paid at the very least $115 million in ransom funds.<\/p>\n U.S. authorities say they traced a few of these funds to Scattered Spider to an Web server managed by Jubair. The criticism states {that a} cryptocurrency pockets found on that server was used to buy a number of reward playing cards, one among which was used at a meals supply firm to ship meals to his residence. One other reward card bought with cryptocurrency from the identical server was allegedly used to fund on-line gaming accounts below Jubair\u2019s identify. U.S. prosecutors mentioned that after they seized that server in addition they seized $36 million in cryptocurrency.<\/p>\n The criticism additionally costs Jubair with involvement in a hacking incident in January 2025 in opposition to the U.S. courts system that focused a U.S. Justice of the Peace choose overseeing a associated Scattered Spider investigation. That different investigation seems to have been the prosecution of Noah Michael City<\/strong>, a 20-year-old Florida man charged in November 2024 by prosecutors in Los Angeles<\/a> as one among 5 alleged Scattered Spider members.<\/p>\n City pleaded responsible in April 2025 to wire fraud and conspiracy costs, and in August he was sentenced to 10 years in federal jail. Talking with KrebsOnSecurity from jail after his sentencing, City asserted that the choose case gave him extra time than prosecutors requested as a result of he was mad that Scattered Spider hacked his e mail account<\/a>.<\/p>\n Noah \u201cKingbob\u201d City, posting to Twitter\/X across the time of his sentencing on Aug. 20.<\/p>\n<\/div>\n A\u00a0court docket transcript<\/a> (PDF) from a standing listening to in February 2025 exhibits City was telling the reality in regards to the hacking incident that occurred whereas he was in federal custody. The choose informed attorneys for each side {that a} co-defendant within the California case was looking for out about Mr. City\u2019s exercise within the Florida case, and that the hacker accessed the account by impersonating a choose over the cellphone and requesting a password reset.<\/p>\n Allison Nixon<\/strong> is chief analysis officer on the New York based mostly safety agency Unit 221B<\/strong>, and simply one of many world\u2019s main specialists on Com-based cybercrime exercise. Nixon mentioned the core downside with legally prosecuting well-known cybercriminals from the Com has historically been that the highest offenders are usually below the age of 18, and thus troublesome to cost below federal hacking statutes.<\/p>\n In america, prosecutors usually wait till an underage cybercrime suspect turns into an grownup to cost them. However till that day comes, she mentioned, Com actors usually really feel emboldened to proceed committing \u2014 and fairly often bragging about \u2014 severe cybercrime offenses.<\/p>\n \u201cRight here we have now a particular class of Com offenders that successfully get pleasure from authorized immunity,\u201d Nixon informed KrebsOnSecurity. \u201cMost get recruited to Com teams when they’re older, however of those who be part of very younger, akin to 12 or 13, they appear to be essentially the most harmful as a result of at that age they don’t have any grounding in actuality and a lot longevity earlier than they exit their authorized immunity.\u201d<\/p>\n Nixon mentioned U.Ok. authorities face the identical problem after they briefly detain and search the houses of underage Com suspects: Particularly, the teenager suspects merely go proper again to their respective cliques within the Com and begin robbing and hurting individuals once more the minute they\u2019re launched.<\/p>\n Certainly, the U.Ok. court docket heard from prosecutors final week that each Scattered Spider suspects had been detained and\/or searched by native regulation enforcement on a number of events, solely to return to the Com lower than 24 hours after being launched every time.<\/p>\n \u201cWhat we see is these younger Com members grow to be vectors for perpetrators to commit enormously dangerous acts and even little one abuse,\u201d Nixon mentioned. \u201cThe members of this particular class of people that get pleasure from authorized immunity are assembly up with overseas nationals and conducting these typically heinous acts at their behest.\u201d<\/p>\n Nixon mentioned many of those people have few pals in actual life as a result of they spend just about all of their waking hours on Com channels, and so their whole sense of id, neighborhood and self-worth will get wrapped up of their involvement with these on-line gangs. She mentioned if\u00a0the regulation was such that prosecutors might deal with these individuals commensurate with the quantity of hurt they trigger society, that may most likely clear up numerous this downside.<\/p>\n \u201cIf regulation enforcement was allowed to maintain them in jail, they’d stop reoffending,\u201d she mentioned.<\/p>\n The Occasions of London<\/em> stories<\/a> that Flowers is dealing with three costs below the Pc Misuse Act: two of conspiracy to commit an unauthorized act in relation to a pc inflicting\/creating danger of great injury to human welfare\/nationwide safety and one among making an attempt to commit the identical act. Most sentences for these offenses can vary from 14 years to life in jail, relying on the affect of the crime.<\/p>\n Jubair is reportedly dealing with two costs within the U.Ok.: Considered one of conspiracy to commit an unauthorized act in relation to a pc inflicting\/creating danger of great injury to human welfare\/nationwide safety and one among failing to adjust to a bit 49 discover to reveal the important thing to protected info.<\/p>\n In america, Jubair is charged with laptop fraud conspiracy, two counts of laptop fraud, wire fraud conspiracy, two counts of wire fraud, and cash laundering conspiracy. If extradited to the U.S., tried and convicted on all costs, he faces a most penalty of 95 years in jail.<\/p>\n In July 2025, the UK barred victims of hacking from paying ransoms to cybercriminal teams except authorized by officers. U.Ok. organizations which can be thought-about a part of crucial infrastructure reportedly<\/a> will face a whole ban, as will your entire public sector. U.Ok. victims of a hack at the moment are required to inform officers to higher inform policymakers on the size of Britain\u2019s ransomware downside.<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/09\/paw-flowers-jubair.png\")
<\/p>\nEARLY DAYS (2021-2022)<\/h2>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2022\/04\/amtraxdox.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2022\/03\/infinityrecursion.png\")
<\/p>\nEARTHTOSTAR<\/h2>\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/07\/ace-earth2star-starchat.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/09\/rocketace-tmobile.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2023\/02\/tmodates.png\")
<\/p>\n\n
![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2022\/08\/amitaico.png\")
<\/p>\nDA, COMRADE<\/h2>\n
\n
-Dynamic phishing pages concentrating on clients of single sign-on suppliers like Okta;
-Malware growth companies;
-The sale of prolonged validation (EV) code signing certificates.<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/09\/kela-lopiu.png\")
<\/p>\n\n
2023-PRESENT DAY<\/h2>\n
\n
\n
bypass firewalls and have reverse shell entry.<\/p>\n
This will vary to easy shells to Bootkits.<\/p>\n
Patch EDR\u2019s scanning performance so it\u2019s rendered ineffective!<\/p>\n
Improvement Expertise of a number of years and in a number of APT Teams.<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/09\/comcast-jubair.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/08\/kingbobtweets.png\")
<\/p>\n