5 Members of the Scattered Spider Cybercrime Group Federally Charged on November 20, 2024

On November 20, 2024, the Department of Justice unsealed criminal charges against five individuals believed to be members of the Scattered Spider cybercrime group. 

From at least September 2021 until April 2023, the defendants and other members of the group allegedly launched advanced social engineering attacks against at least 45 companies, including companies based in the U.S., Canada, the U.K., and India. According to court documents, the defendants sent mass amounts of SMS messages to company employees, claiming to be from the firm or the firm’s information technology or business services contractor. The messages described in the charges claimed the employee’s account was going to be deactivated and provided a link to “reset” the employee’s credentials. Some employees provided their login information through this link and a few authenticated their identities using multi-factorial authentication requests sent to their mobile phones. After harvesting employees’ credentials in this way, the defendants allegedly used the credentials to gain unauthorized access to nonpublic company data and employee information, including confidential work product, intellectual property, account access credentials, names, email addresses, and telephone numbers. The defendants also used stolen information from intrusions into the victim companies and leaked data sets to gain access to individuals’ cryptocurrency accounts and wallets, stealing millions of dollars in digital assets. 

Four of the five defendants were charged by a federal grand jury with one count of conspiracy, one count of conspiracy to commit wire fraud, and one count of aggravated identity theft: 

• Ahmed Hossam Eldin Elbadawy, 23, a.k.a. “AD,” of College Station, Texas;
• Noah Michael Urban, 20, a.k.a. “Sosa” and “Elijah,” of Palm Coast, Florida, who has pleaded not guilty to several fraud charges in a separate federal criminal case in Florida;
• Evans Onyeaka Osiebo, 20, of Dallas, Texas; and
• Joel Martin Evans, 25, a.k.a. “joeleoli,” of Jacksonville, North Carolina.

The fifth defendant, Tyler Robert Buchanan, 22, of the United Kingdom, was charged with conspiracy to commit wire fraud, conspiracy, wire fraud, and aggravated identity theft. 

The case is being prosecuted in the Central District of California. If they are convicted, each defendant faces up to 20 years in federal prison for conspiracy to commit wire fraud, up to five years in federal prison for conspiracy, and a mandatory two-year consecutive prison sentence for aggravated identity theft. Buchanan would face an additional maximum sentence of 20 years in prison for the wire fraud count. 

Authored by Nathan Salminen and Madison Cash.