{"id":3820,"date":"2026-06-23T17:04:32","date_gmt":"2026-06-23T17:04:32","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/"},"modified":"2026-06-23T17:04:32","modified_gmt":"2026-06-23T17:04:32","slug":"scattered-spider-hackers-plead-guilty-on-day-1-of-trial","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/","title":{"rendered":"Scattered Spider Hackers Plead Guilty on Day 1 of Trial"},"content":{"rendered":"
\n

Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London<\/strong>, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider<\/strong>, and their guilty pleas came on the first day of what was expected to be a six-week trial.<\/p>\n

\"\"<\/p>\n

Owen Flowers (left) 18, and Thalha Jubair, 20. Image: UK National Crime Agency (NCA).<\/p>\n<\/div>\n

Thalha Jubair<\/strong>, 20, of East London and 18-year-old Owen Flowers<\/strong> of Walsall admitted conspiring to commit unauthorized acts against Transport for London computer systems and causing risk of serious damage to human welfare. According to a report<\/a> from the BBC, Flowers alone admitted to being part of a conspiracy to hack into U.S. based healthcare providers SSM Health Care Corporation and Sutter Health in September 2024.<\/p>\n

Jubair is also wanted by U.S. law enforcement agencies. In September 2025, prosecutors in New Jersey unsealed an indictment<\/a> alleging Jubair and other Scattered Spider members committed computer fraud, wire fraud, and money laundering in relation to 120 computer network intrusions involving 47 U.S. entities between May 2022 and September 2025, and that the group\u2019s victims paid at least $115 million in ransom payments.<\/p>\n

In July 2025, KrebsOnSecurity reported<\/a> that Flowers and Jubair were arrested in the United Kingdom in connection with Scattered Spider ransom attacks<\/a>\u00a0against the retailers\u00a0Marks & Spencer<\/strong>\u00a0and\u00a0Harrods<\/strong>, and the British food retailer\u00a0Co-op Group<\/strong>. Multiple sources familiar with those investigations said Flowers was the Scattered Spider member who anonymously gave interviews to the media<\/a> in the days after the group\u2019s September 2023 ransomware attacks disrupted operations at Las Vegas casinos operated by MGM Resorts<\/strong>\u00a0and\u00a0Caesars Entertainment<\/strong>.<\/p>\n

According to prosecutors, Jubair co-ran a bustling Telegram channel called Star Chat<\/strong>, the home of a SIM-swapping<\/a> group that used voice- and SMS-based phishing attacks to steal credentials from employees at the major wireless providers in the U.S. and U.K. The group would then use that access to sell a service that could redirect a target\u2019s phone number to a device the attackers controlled and intercept the victim\u2019s calls and text messages (including one-time codes for multi-factor authentication).<\/p>\n

\"\"<\/p>\n

A receipt from Star Fraud Chat\u2019s SIM-swapping service targeting a T-Mobile customer after the group gained access to internal T-Mobile employee tools. \u201cRocket Ace\u201d was one of Jubair\u2019s hacker handles, according to U.S. prosecutors.<\/p>\n<\/div>\n

New Jersey prosecutors also allege Jubair also was involved in a mass SMS phishing campaign during the summer of 2022<\/a> that stole single sign-on credentials from employees at hundreds of companies.\u00a0That weeks-long SMS phishing campaign led to intrusions and data thefts at more than 130 organizations, including LastPass<\/strong>,\u00a0DoorDash<\/strong>,\u00a0Mailchimp<\/strong>,\u00a0Plex<\/strong>\u00a0and\u00a0Signal<\/strong>.<\/span><\/p>\n

KrebsOnSecurity reported last year that one of Jubair\u2019s alter egos at age 15 was \u201cEverlynn<\/strong>,\u201d a hacker who sold fraudulent \u201cemergency data requests\u201d<\/a> that used compromised police and government email addresses to demand subscriber data (e.g. username, IP\/email address) from major tech companies, claiming the requests concerned urgent matters of life and death and could not wait for a court order.<\/p>\n

In April 2026, 24-year-old British national and Scattered Spider member Tyler \u201cTylerb\u201d Buchanan<\/strong> pleaded guilty<\/a> to wire fraud conspiracy and aggravated identity theft for participating in the group\u2019s SMS phishing spree in the summer of 2022. The government said Buchanan, Jubair and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States. Buchanan is currently scheduled to be sentenced on October 2.<\/p>\n

In August 2025, 20-year-old Scattered Spider member from Florida named Noah Michael Urban<\/strong> was sentenced to 10 years in federal prison<\/a> and ordered to pay $13 million in restitution, after pleading guilty to charges of wire fraud and conspiracy.<\/p>\n

The U.S. Department of Justice says three alleged Scattered Spider defendants indicted along with Buchanan still face charges, including Ahmed Hossam Eldin Elbadawy<\/strong>, 24, a.k.a. \u201cAD,\u201d of College Station, Texas; Evans Onyeaka Osiebo<\/strong>, 21, of Dallas, Texas; and Joel Martin Evans<\/strong>, 26, a.k.a. \u201cjoeleoli,\u201d of Jacksonville, North Carolina.<\/p>\n

Flowers and Jubair are slated to be sentenced in a London court on July 15, 2026.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[1326,90,1327,115,1051,106,131,1052,1328,1329],"tags":[91],"class_list":["post-3820","post","type-post","status-publish","format-standard","hentry","category-bbc","category-cybersecurity","category-everlynn","category-neer-do-well-news","category-owen-flowers","category-ransomware","category-scattered-spider","category-thalha-jubair","category-transport-for-london","category-tyler-tylerb-buchanan","tag-cybersecurity"],"yoast_head":"\nScattered Spider Hackers Plead Guilty on Day 1 of Trial - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-06-23T17:04:32+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Scattered Spider Hackers Plead Guilty on Day 1 of Trial\",\"datePublished\":\"2026-06-23T17:04:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\"},\"wordCount\":700,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"BBC\",\"Cybersecurity\",\"Everlynn\",\"Ne'er-Do-Well News\",\"Owen Flowers\",\"Ransomware\",\"Scattered Spider\",\"Thalha Jubair\",\"Transport for London\",\"Tyler "Tylerb" Buchanan\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\",\"name\":\"Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png\",\"datePublished\":\"2026-06-23T17:04:32+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Scattered Spider Hackers Plead Guilty on Day 1 of Trial\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/","og_locale":"en_US","og_type":"article","og_title":"Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Imperative Business Ventures Limited","og_description":"Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area. The duo were key members of a prolific cybercrime group known as Scattered Spider, and their guilty pleas […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-06-23T17:04:32+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Scattered Spider Hackers Plead Guilty on Day 1 of Trial","datePublished":"2026-06-23T17:04:32+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/"},"wordCount":700,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png","keywords":["Cybersecurity"],"articleSection":["BBC","Cybersecurity","Everlynn","Ne'er-Do-Well News","Owen Flowers","Ransomware","Scattered Spider","Thalha Jubair","Transport for London","Tyler "Tylerb" Buchanan"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/","name":"Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png","datePublished":"2026-06-23T17:04:32+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2026\/06\/flowers-jubair-nca.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/06\/23\/scattered-spider-hackers-plead-guilty-on-day-1-of-trial\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Scattered Spider Hackers Plead Guilty on Day 1 of Trial"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=3820"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/3820\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=3820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=3820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=3820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}