{"id":2868,"date":"2025-09-19T03:53:48","date_gmt":"2025-09-19T03:53:48","guid":{"rendered":"http:\/\/ft365.org\/index.php\/2025\/09\/19\/pair-of-suspected-scattered-spider-hackers-charged-by-uk-us-authorities\/"},"modified":"2025-09-19T03:53:48","modified_gmt":"2025-09-19T03:53:48","slug":"pair-of-suspected-scattered-spider-hackers-charged-by-uk-us-authorities","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2025\/09\/19\/pair-of-suspected-scattered-spider-hackers-charged-by-uk-us-authorities\/","title":{"rendered":"Pair of Suspected Scattered Spider Hackers Charged by UK, US Authorities"},"content":{"rendered":"
\n

US and UK authorities have charged two suspected members of the infamous Scattered Spider cybercrime group with offenses connected to multiple high-profile cyber-attacks.<\/p>\n

The pair have been linked to attacks on US courts, a US critical infrastructure firm and the UK\u2019s Transport for London (TfL).<\/p>\n

The two UK-based individuals, Thalha Jubair, 19, from East London, and Owen Flowers, 18 from Walsall, were arrested at their home addresses on Tuesday, September 16.<\/p>\n

The District of New Jersey unsealed charges against Jubair on September 18, with conspiracies to commit computer fraud, wire fraud and money laundering.<\/p>\n

According to the charges, Jubair, also known as \u201cEarthtoStar,\u201d\u00a0 \u201cBrad,\u201d \u201cAustin,\u201d and \u201c@autistic,\u201d conspired with others to use social engineering techniques to gain unauthorized access into the computer networks of victim companies.<\/p>\n

Jubair is accused of participation in at least 120 computer network intrusions and extortion involving 47 US entities. It is believed that victims paid at least $115m in ransom payments to Jubair and his associates.<\/p>\n

Portions of the ransom payments from at least five victims were sent to wallets on a server controlled by Jubair.<\/p>\n

In July 2024, Jubair was observed transferring a portion of cryptocurrency that originated from one of the victims, worth approximately $8.4m at the time, to another wallet, while law enforcement was in the process of seizing the server.<\/p>\n

Jubair and associates are accused of involvement in attacks from as early as May 2022 to as recently as September 2025.<\/p>\n

FBI Special Agent in charge Stefanie Roddy, said: \u201cThe arrest of Thalha Jubair underscores an undeniable truth: no matter how elusive or destructive these cyber-criminal syndicates are, we will continue to pursue those who allegedly extort our businesses and ensure they are held accountable.\u201d<\/p>\n

Teenagers Charged with TfL Hack Involvement<\/strong><\/h2>\n

The two teenagers have also been charged by UK authorities with offenses connected to the August 2024 cyber-attack on Transport for London (TfL).<\/p>\n

They have been charged with conspiring to commit unauthorized acts against TfL under the Computer Misuse Act and appeared in Westminster Magistrates Court on September 18.<\/p>\n

Flowers was initially arrested on suspicion of involvement in the TfL hack on September 6, 2024, while aged 17, at which point National Crime Agency (NCA) investigators identified further potential evidence of offences against US healthcare companies.<\/p>\n

As a result, he was also charged on September 18, 2025 with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health\u2019s networks, both based in the US.<\/p>\n

Jubair has been additionally charged under the UK\u2019s Regulation of Investigatory Powers Act (RIPA) for failing to disclose the pin or passwords for devices seized from him.<\/p>\n

The TfL hack impacted sensitive personal data of around 5000 customers. This information included Oyster refund data, encompassing bank account numbers and sort codes.<\/p>\n

It reportedly cost the transport operator around \u00a330m ($40.6m), including \u00a35m ($6.7m) on external support to recover from the incident.<\/p>\n

New Blow to Scattered Spider<\/strong><\/h2>\n

The charges against Flowers and Jubair follow the arrests of four other suspected members of Scattered Spider by UK authorities in July 2025.<\/p>\n

The four individuals, three of whom were teenagers at the time of the arrest, are suspected of involvement in the April 2025 the attacks on Marks & Spencer, the Co-op and Harrods.<\/p>\n

Deputy Director Paul Foster, head of the NCA\u2019s National Cyber Crime Unit, described the charges against Jubair and Flowers as a \u201ckey step\u201d in a \u201clengthy and complex investigation.\u201d<\/p>\n

\u201cThis attack caused significant disruption and millions in losses to TfL, part of the UK\u2019s critical national infrastructure,\u201d he said, \u201cEarlier this year, the NCA warned of an increase in the threat from cybercriminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.\u201d<\/p>\n

Commenting on the charges, Jake Moore, global cybersecurity advisor at ESET and former UK police officer, highlighted the growing success of law enforcement in identifying and collecting evidence to prosecute cybercriminal actors.<\/p>\n

However, he warned that there may still be significant challenges in this process.<\/p>\n

\u201cCollecting enough solid evidence to produce in court and prosecute is the most difficult aspect in any cybercrime investigation so it will be vital that these agencies work thoroughly towards locating outright proof of their involvement,\u201d he noted.<\/p>\n

\u201cIt is highly likely that these members of the gang will have reduced their evidence and communication trails down to a bare minimum, if at all, which will cause frustrations in the investigation,\u201d Moore added.<\/p>\n

Earlier in September, it was reported that Scattered Spider, along with 14 other ransomware groups, had announced their \u201cretirement.\u201d However, these announcements have been met with skepticism by security experts.<\/p>\n

The arrests and charges against Jubair and Flowers followed a collaborative investigation between law enforcement agencies in the UK, the US, the Netherlands, Romania, Canada and Australia.<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

US and UK authorities have charged two suspected members of the infamous Scattered Spider cybercrime group with offenses connected to multiple high-profile cyber-attacks. The pair have been linked to attacks on US courts, a US critical infrastructure firm and the UK\u2019s Transport for London (TfL). The two UK-based individuals, Thalha Jubair, 19, from East London<\/p>\n","protected":false},"author":2,"featured_media":2869,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2868","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"featured_image_urls":{"full":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"thumbnail":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553-150x150.jpg",150,150,true],"medium":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"medium_large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"1536x1536":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"2048x2048":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"morenews-featured":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"morenews-large":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"morenews-medium":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553.jpg",300,300,false],"crawlomatic_preview_image":["http:\/\/ft365.org\/wp-content\/uploads\/2025\/09\/2868-712c74b9-3ceb-4129-85fe-78c072796553-146x146.jpg",146,146,true]},"author_info":{"display_name":"henry","author_link":"http:\/\/ft365.org\/index.php\/author\/henry\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","_links":{"self":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/2868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/comments?post=2868"}],"version-history":[{"count":0,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/posts\/2868\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media\/2869"}],"wp:attachment":[{"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/media?parent=2868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/categories?post=2868"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/ft365.org\/index.php\/wp-json\/wp\/v2\/tags?post=2868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}