The Extradition and Charges
A 19 year old dual US and Estonian citizen, Peter Stokes, has been extradited to the United States from Finland. He was arrested in April at Helsinki Airport while attempting to board a flight to Japan. Stokes faces federal charges of fraud, conspiracy, and computer intrusion for his alleged role as a member of the Scattered Spider hacking collective.
According to court documents, Stokes participated in multiple breaches, including a March 2023 attack on an online communication platform when he was 16. He is also accused of involvement in a May 2025 hack of a luxury item retailer, where the group posed as employees in calls to the company’s IT helpdesk to reset credentials and gain administrative access. The attackers demanded an $8 million ransom, but the company refused to pay, though it incurred over $2 million in disruption and remediation costs.
Scattered Spider Tactics and Impact
Scattered Spider, also tracked as 0ktapus and Octo Tempest, emerged in 2022 as a loosely organized group of teenagers and young adults from the US and UK. They are known for using social engineering, MFA fatigue attacks via the Genymobile Android emulator, and SMS credential phishing. The group has been linked to over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages.
High profile victims include Caesars, MGM Resorts, Riot Games, DoorDash, Reddit, Twilio, Transport for London, Jaguar Land Rover, and several UK retailers. The US Department of Justice stated that Scattered Spider repeatedly targeted American companies, extorting employees and disrupting essential operations. Stokes remains in custody after appearing in federal court in Chicago.
Source: BleepingComputer
