[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhLVUfanJ9VarmCSGBRtUYYThasIAuWE-wQ18_pcmq4E":3},{"article":4,"iocs":45,"watch_terms":60,"solutions":61,"lesson":64},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":27},"d19a443a-182f-4723-b469-8178a080f33f","Alleged Scattered Spider Hacker Extradited to US","alleged-scattered-spider-hacker-extradited-to-us-c1ee7a","Prosecutors say 19-year-old Peter Stokes was a member of Scattered Spider, the hacking group linked to more than 100 network intrusions and over $100 million in ransom payments. The post Alleged Scattered Spider Hacker Extradited to US appeared first on SecurityWeek.","Peter Stokes, a 19-year-old dual US-Estonian citizen, has been extradited to the US to face charges related to his alleged involvement with the Scattered Spider hacking group. The group, also known by several other aliases, is suspected of over 100 network intrusions and extorting more than $100 million. Stokes is accused of participating in a ransomware attack against a luxury jewelry retailer that caused at least $2 million in losses.","Alleged Scattered Spider hacker Peter Stokes extradited to US to face charges.","https:\u002F\u002Fwww.securityweek.com\u002Falleged-scattered-spider-hacker-extradited-to-us\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F07\u002FScattered-Spider.jpeg","2026-07-03T09:30:00+00:00","2026-07-03T10:00:26.908396+00:00",8,[17,20],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":19},"Bouquet","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":22,"icon":24,"name":25,"slug":26},null,"Nation-state","nation-state",[28,33,35,40],{"category":29},{"id":30,"icon":24,"name":31,"slug":32},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":34},{"id":22,"icon":24,"name":25,"slug":26},{"category":36},{"id":37,"icon":24,"name":38,"slug":39},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":41},{"id":42,"icon":24,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,52,54,56,58],{"type":47,"value":48,"context":49},"malware","0ktapus","Alias for Scattered Spider campaign",{"type":47,"value":51,"context":49},"Muddled Libra",{"type":47,"value":53,"context":49},"Octo Tempest",{"type":47,"value":55,"context":49},"Starfraud",{"type":47,"value":57,"context":49},"Scatter Swine",{"type":47,"value":59,"context":49},"UNC3944",[],{"controls":62,"vendors":63},[],[],{"slug":65,"title":66,"body":67,"framework_refs":68,"framework_notes":82},"scattered-spider-member-extradited-100m-hacking-spree-highlights-social-engineering-risks","Scattered Spider Member Extradited: $100M Hacking Spree Highlights Social Engineering Risks","The Scattered Spider group conducted over 100 network intrusions largely by exploiting human vulnerabilities — using social engineering, SIM swapping, and phishing to bypass technical controls rather than exploiting unpatched software. This case underscores that even well-resourced organizations can be compromised when employees are manipulated into granting access or resetting credentials for malicious actors. The $100M+ in extortion damages demonstrates the devastating financial impact of ransomware attacks enabled by initial access gained through human deception. Organizations must recognize that technical defenses alone are insufficient when threat actors specifically target the human layer of security.",[69,70,71,72,73,74,75,76,77,78,79,80,81],"CIS Control 4 — Secure Configuration of Enterprise Assets","CIS Control 6 — Access Control Management","CIS Control 14 — Security Awareness and Skills Training","CIS Control 17 — Incident Response Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 IR-4 (Incident Handling)","NIST SP 800-63B (Digital Identity Guidelines — AAL3 Phishing-Resistant MFA)","NIST CSF DE.CM-3 (Personnel activity monitoring)","MITRE ATT&CK T1078 (Valid Accounts)","MITRE ATT&CK T1534 (Internal Spearphishing)","MITRE ATT&CK T1486 (Data Encrypted for Impact — Ransomware)","GDPR Article 32 (Security of Processing — where EU data subjects are involved)",{}]