- 817
- 220
Ten years behind bars is a fair price for playing “digital god.” A member of the Scattered Spider cybercriminal group has been sentenced in the United States. Noah Michael Urban, 20, also known by the pseudonyms Sosa, Elijah, King Bob, Gustavo Fring, and Anthony Ramirez, received 10 years in prison on charges of wire fraud and identity theft. In addition to the term in federal prison, he was sentenced to three years of post-release supervision and an obligation to pay $13 million in restitution to the victims. The investigation established that between August 2022 and March 2023, Urban and his accomplices organized a series of attacks using SIM Swapping technology, intercepting control of victims' phone numbers. This allowed them to access cryptocurrency wallets and steal digital assets. According to the US Department of Justice, during this period alone, they stole at least $800,000 from at least five people. Urban was arrested in January 2024 in Florida and pleaded guilty in April of this year. In addition to him, the US Department of Justice formally charged four more members of Scattered Spider. These defendants are also suspected of carrying out attacks on the corporate networks of American companies through social engineering. Their goals were both to steal confidential data and to steal millions of dollars in cryptocurrency. Among the other defendants is Tyler Robert Buchanan, who was detained in Spain in June 2024. In the spring of 2025, he was extradited to the United States for further proceedings. The backdrop to these events is the ongoing unification of cybercriminal groups. Scattered Spider, which previously operated autonomously, has now entered into an alliance with other well-known groups - LAPSUS$ and ShinyHunters. All three are part of a larger English-language conglomerate called The Com, which specializes in extortion, blackmail, credential theft, and ransomware deployment. According to analyst Adam Darrah of ZeroFox, Scattered Spider is known for its deliberate use of pressure tactics — from threats of public leaks to countdown timers — to speed up payouts. Such tactics are aimed at creating an atmosphere of fear and attracting media attention, which further encourages victims to capitulate. Flashpoint, which recently published a detailed dossier on Scattered Spider, emphasized that the group operates in waves: it selects a specific industry and attacks as many of its representatives as possible in a short period of time. The group’s focus is not on vulnerabilities in code, but on people.
They actively use social engineering techniques: calls with a spoofed number (vishing), fraudulent SMS (smishing) and attacks on the so-called "multi-factor authentication fatigue" (MFA fatigue). All this makes it possible to bypass even the most modern technical security measures.
Scattered Spider remains one of the most daring and inventive threats in the field of digital security, skillfully combining psychological pressure with the technical complexity of its operations. Urban's sentence is an important step in trying to stop this wave of attacks, but in the context of the ongoing consolidation of hacker alliances, the question of their final suppression remains open.
They actively use social engineering techniques: calls with a spoofed number (vishing), fraudulent SMS (smishing) and attacks on the so-called "multi-factor authentication fatigue" (MFA fatigue). All this makes it possible to bypass even the most modern technical security measures.
Scattered Spider remains one of the most daring and inventive threats in the field of digital security, skillfully combining psychological pressure with the technical complexity of its operations. Urban's sentence is an important step in trying to stop this wave of attacks, but in the context of the ongoing consolidation of hacker alliances, the question of their final suppression remains open.