[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOPBQqh0vX9iKeAqMZkH930h0vCdbWuo7vIbHrEWB6RU":3},{"article":4,"iocs":58,"watch_terms":73,"solutions":74,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"5d82f78f-7cf5-4f3c-83d9-679d1bcedf06","Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker","court-filing-reveals-windows-device-id-helped-fbi-trace-alleged-scattered-spider-505504","U.S. prosecutors linked an alleged Scattered Spider hacker to a break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID first to the account the attackers used to keep access during the May 2025 intrusion, then to online accounts prosecutors say belong to 19-year-old Peter Stokes. Stokes is","U.S. prosecutors linked 19-year-old Peter Stokes (alias \"Bouquet\") to a May 2025 break-in at a luxury jewelry retailer using a persistent Windows Global Device Identifier. Attackers used social engineering to reset employee credentials via help desk, gaining access to admin accounts, exfiltrating 77GB of data, and demanding $8M in ransom. Microsoft's device tracking records connected the intrusion device to Stokes's online accounts across Snapchat, Apple, and Facebook, corroborated by travel records and IP geolocation data.","FBI traced alleged Scattered Spider hacker using Windows device ID from luxury jewelry retailer breach.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fcourt-filing-reveals-windows-device-id.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiRD_854zsswRvh7xWklnbEkAjmk7UZy_-dQzlueMbq1ib7deDs-QH0av7XRZ1WEq3vcX57cDDcioIdkebKCiF7qr8xC9Evw7GmFuDS0kQt3mnpXgb3Q2H62eHPIgCy3rk1Mj3uM-Mge0XTfMgSCGaumk3i5KatoyrFnu_PUhg8cZGY1ZAd185qsNqZ1jE\u002Fs1600\u002Fmd-id.jpg","2026-07-07T13:27:20+00:00","2026-07-07T14:00:12.366624+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":19},"Peter Stokes (alias: Bouquet)",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":27},"Global Device Identifier (GDI)","technology",{"name":29,"type":27},"FIDO2",{"name":31,"type":24},"Group-IB","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":32,"icon":34,"name":35,"slug":36},null,"Breaches","breaches",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[59,63,67,70],{"type":60,"value":61,"context":62},"mitre_attack","T1078.004 - Valid Accounts: Cloud Accounts","Attackers compromised legitimate employee accounts and IT admin accounts for network persistence",{"type":64,"value":65,"context":66},"malware","ngrok","Tunneling tool installed by attackers to maintain access and exfiltrate data",{"type":64,"value":68,"context":69},"Teleport","Secondary tunneling tool deployed for persistent access",{"type":60,"value":71,"context":72},"T1091 - Replication Through Removable Media \u002F T1566.002 - Phishing: Spearphishing Link","Social engineering via Google Voice impersonation to bypass MFA and reset credentials",[23,31],{"controls":75,"vendors":156},[76,105,127],{"slug":77,"name":78,"problem":79,"products":80},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":106,"name":107,"problem":108,"products":109},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},{"slug":128,"name":129,"problem":130,"products":131},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[132,140,148],{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":149,"vendor_name":150,"vendor_logo":151,"product_slug":152,"product_name":153,"url":154,"description":155},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":180},"social-engineering-weak-help-desk-controls-led-to-8m-ransomware-demand","Social Engineering + Weak Help Desk Controls Led to $8M Ransomware Demand","Attackers exploited the human element by using social engineering to manipulate help desk staff into resetting employee credentials, bypassing technical controls entirely and gaining administrative access. Once inside, 77GB of sensitive data was exfiltrated before a ransom demand was issued — a classic ransomware playbook enabled by insufficient identity verification procedures. Ironically, the attacker was caught because Microsoft's persistent Windows Global Device Identifier created an immutable digital trail linking the intrusion device to the suspect's online accounts. This case underscores that strong perimeter defenses mean little if help desk processes can be manipulated to hand over the keys, and that persistent device telemetry can be a powerful forensic asset for investigators.",[162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179],"CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 SI-4: System Monitoring","NIST CSF PR.AC-1: Identity and Credential Management","NIST CSF DE.CM-1: Network Monitoring","MITRE ATT&CK T1078: Valid Accounts","MITRE ATT&CK T1566: Phishing \u002F Social Engineering","MITRE ATT&CK T1041: Exfiltration Over C2 Channel","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of a Personal Data Breach","ITIL Service Desk Identity Verification Best Practices",{}]