{“lastseen”:”2026-06-23T17:56:26″,”description”:”Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled **Transport for London** , the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as **Scattered Spider** , and their guilty pleas came on the first day of what was expected to be a six-week trial.\\n\\n\\n\\nOwen Flowers (left) 18, and Thalha Jubair, 20. Image: UK National Crime Agency (NCA).\\n\\n**Thalha Jubair** , 20, of East London and 18-year-old **Owen Flowers** of Walsall admitted conspiring to commit unauthorized acts against Transport for London computer systems and causing risk of serious damage to human welfare. According to a report from the BBC, Flowers alone admitted to being part of a conspiracy to hack into U.S. based healthcare providers SSM Health Care Corporation and Sutter Health in September 2024.\\n\\nJubair is also wanted by U.S. law enforcement agencies. In September 2025, prosecutors in New Jersey unsealed an indictment alleging Jubair and other Scattered Spider members committed computer fraud, wire fraud, and money laundering in relation to 120 computer network intrusions involving 47 U.S. entities between May 2022 and September 2025, and that the group\u2019s victims paid at least $115 million in ransom payments.\\n\\nIn July 2025, KrebsOnSecurity reported that Flowers and Jubair were arrested in the United Kingdom in connection with Scattered Spider ransom attacks against the retailers **Marks \\u0026 Spencer** and **Harrods** , and the British food retailer **Co-op Group**. Multiple sources familiar with those investigations said Flowers was the Scattered Spider member who anonymously gave interviews to the media in the days after the group\u2019s September 2023 ransomware attacks disrupted operations at Las Vegas casinos operated by **MGM Resorts** and **Caesars Entertainment**.\\n\\nAccording to prosecutors, Jubair co-ran a bustling Telegram channel called **Star Chat** , the home of a SIM-swapping group that used voice- and SMS-based phishing attacks to steal credentials from employees at the major wireless providers in the U.S. and U.K. The group would then use that access to sell a service that could redirect a target\u2019s phone number to a device the attackers controlled and intercept the victim\u2019s calls and text messages (including one-time codes for multi-factor authentication).\\n\\n\\n\\nA receipt from Star Fraud Chat’s SIM-swapping service targeting a T-Mobile customer after the group gained access to internal T-Mobile employee tools. \\”Rocket Ace\\” was one of Jubair’s hacker handles, according to U.S. prosecutors.\\n\\nNew Jersey prosecutors also allege Jubair also was involved in a mass SMS phishing campaign during the summer of 2022 that stole single sign-on credentials from employees at hundreds of companies. That weeks-long SMS phishing campaign led to intrusions and data thefts at more than 130 organizations, including **LastPass** , **DoorDash** , **Mailchimp** , **Plex** and **Signal**.\\n\\nKrebsOnSecurity reported last year that one of Jubair’s alter egos at age 15 was \\”**Everlynn** ,\\” a hacker who sold fraudulent \\”emergency data requests\\” that used compromised police and government email addresses to demand subscriber data (e.g. username, IP\/email address) from major tech companies, claiming the requests concerned urgent matters of life and death and could not wait for a court order.\\n\\nIn April 2026, 24-year-old British national and Scattered Spider member **Tyler \\”Tylerb\\” Buchanan** pleaded guilty to wire fraud conspiracy and aggravated identity theft for participating in the group’s SMS phishing spree in the summer of 2022. The government said Buchanan, Jubair and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States. Buchanan is currently scheduled to be sentenced on October 2.\\n\\nIn August 2025, 20-year-old Scattered Spider member from Florida named **Noah Michael Urban** was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution, after pleading guilty to charges of wire fraud and conspiracy.\\n\\nThe U.S. Department of Justice says three alleged Scattered Spider defendants indicted along with Buchanan still face charges, including **Ahmed Hossam Eldin Elbadawy** , 24, a.k.a. \u201cAD,\u201d of College Station, Texas; **Evans Onyeaka Osiebo** , 21, of Dallas, Texas; and **Joel Martin Evans** , 26, a.k.a. \u201cjoeleoli,\u201d of Jacksonville, North Carolina.\\n\\nFlowers and Jubair are slated to be sentenced in a London court on July 15, 2026.”,”published”:”2026-06-23T16:12:49″,”modified”:”2026-06-23T16:12:49″,”type”:”krebs”,”title”:”Scattered Spider Hackers Plead Guilty on Day 1 of Trial”,”source”:””,”references”:””,”id”:”KREBS:558FBF80A49DC11494BE85348DDCC692″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/krebsonsecurity.com\/2026\/06\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-06-23T17:56:26″,”description”:”Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled **Transport for London** ,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,119,13,33,7,11,5],"class_list":["post-65176","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-krebs","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n