[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f66f2_SjSDfVoihHY-RS6xdBWPBfgX9qOOl62EC_YMBg":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":63},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"40c075f7-0c58-4691-8d82-c7ad858d8ac2","Scattered Spider Hackers Plead Guilty on Day 1 of Trial","scattered-spider-hackers-plead-guilty-on-day-1-of-trial-962d41","Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial.","Two key members of the Scattered Spider cybercrime group, Owen Flowers and Thalha Jubair, have pleaded guilty in the UK to charges related to a cyberattack that crippled Transport for London. Their pleas occurred on the first day of their trial. The duo are also implicated in numerous other attacks, including breaches of US healthcare providers and a large-scale SMS phishing campaign that targeted multiple companies and resulted in significant ransom payments.","Two Scattered Spider hackers plead guilty in UK for cyberattacks on TfL and US healthcare.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F06\u002Fscattered-spider-hackers-plead-guilty-on-day-1-of-trial\u002F","https:\u002F\u002Fkrebsonsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fflowers-jubair-nca.png","2026-06-23T16:12:49+00:00","2026-06-23T18:00:22.616218+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"Scattered Spider","threat_actor",{"name":21,"type":22},"Star Chat","product",{"name":24,"type":22},"Star Fraud Chat",{"name":26,"type":27},"Transport for London","vendor",{"name":29,"type":27},"SSM Health Care Corporation",{"name":31,"type":27},"Sutter Health","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":18,"context":58},"malware","Name of the cybercrime group",[26,29,31],{"controls":61,"vendors":62},[],[],{"slug":64,"title":65,"body":66,"framework_refs":67,"framework_notes":80},"scattered-spiders-sms-phishing-spree-highlights-human-layer-vulnerabilities","Scattered Spider's SMS Phishing Spree Highlights Human-Layer Vulnerabilities","The Scattered Spider group exploited human vulnerabilities through large-scale SMS phishing (smishing) campaigns to gain initial access to high-profile organizations, including Transport for London and US healthcare providers. Rather than relying solely on technical exploits, the group manipulated employees into surrendering credentials or MFA tokens, demonstrating that technical defenses alone are insufficient. The attacks resulted in significant ransom payments and operational disruption, including to critical public infrastructure. This case underscores that employees at all levels remain a primary attack vector, and that layered defenses — combining user education, strong authentication, and rapid incident response — are essential to resilience.",[68,69,70,71,72,73,74,75,76,77,78,79],"CIS Control 5 – Account Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant MFA)","NIST CSF ID.RA-1 – Asset Vulnerabilities Identified","NIST CSF PR.AT-1 – Users Informed and Trained","NIST CSF RS.CO-2 – Incidents Reported per Established Criteria","MITRE ATT&CK T1566.002 – Phishing: Spearphishing via SMS","MITRE ATT&CK T1621 – MFA Request Generation (MFA Fatigue)","GDPR Article 32 – Security of Processing (applicable to healthcare breach victims)","HIPAA Security Rule §164.308(a)(5) – Security Awareness and Training","ITIL Service Continuity Management – Minimizing impact of disruptive incidents",{}]