Nation-stateJul 1, 2026

19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges

19-year-old Scattered Spider member extradited from Finland to face U.S. hacking charges.

Peter Stokes, 19, a dual U.S.-Estonian citizen operating under the handle "Bouquet," was extradited from Finland to the U.S. to face charges of conspiracy, computer intrusion, and fraud related to Scattered Spider attacks. Finnish police arrested him in April after he was spotted at Helsinki airport attempting to board a flight to Japan, seizing two 2-terabyte hard drives. Stokes is part of a broader crackdown on Scattered Spider (also tracked as Octo Tempest, UNC3944, 0ktapus), a loosely organized group of young hackers linked to over 100 network intrusions resulting in more than $100 million in ransom payments.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

The lesson from this incident

Full lesson

Scattered Spider exploits a critical human vulnerability: skilled social engineering targeting helpdesks and identity providers like Okta to bypass technical controls entirely, making even well-patched organizations susceptible. The group's success — over 100 intrusions and $100 million in ransom — demonstrates that strong perimeter defenses mean little when attackers manipulate employees into granting access. Young, English-speaking members blend naturally into corporate environments, using vishing (voice phishing) and SIM swapping to impersonate employees and reset MFA credentials. This case underscores that identity security and employee awareness are now frontline defenses, not afterthoughts.

What helps against this

How we list vendors

Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
For exampleMicrosoft Entra ID Yubico YubiKey Cisco Duo all options
Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleCrowdStrike Falcon Identity Protection Acalvio ShadowPlex Identity Protection Huntress Managed ITDR all options
Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
For exampleHuntress Managed Security Awareness Training Hoxhunt KnowBe4 Security Awareness Training all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — Scattered Spider

Entities

Scattered Spider (threat_actor)Peter Stokes (Bouquet) (threat_actor)Tyler Buchanan (threat_actor)Noah Urban (threat_actor)Thalha Jubair (threat_actor)Owen Flowers (threat_actor)