DOJ: Scattered Spider Netted $115 Million in Ransoms — and Breached the U.S. Courts

A Network of Chaos

Category: Cybercrime / National Security / Critical Infrastructure
Features: Ransomware profits, court system breach, law enforcement collaboration, cryptocurrency tracing
Delivery Method: DOJ complaint, FBI/NCA joint investigation, unsealed court filings
Threat Actor: Scattered Spider cybercrime collective

For years, the name Scattered Spider has hovered at the edge of infamy — a loose collective of mostly English-speaking cybercriminals tied to social engineering campaigns that crippled airlines, casinos, insurers, and retailers. Now, the Justice Department has confirmed the scale of the damage: at least $115 million in ransom payments and one of the most brazen targets yet — the U.S. federal court system itself.

According to a complaint unsealed this week, the group’s campaign spanned May 2022 through September 2025, during which they carried out 120+ attacks across 47 U.S. entities. Their favored method was simple but devastating: impersonate employees on helpdesk calls, reset passwords, hijack accounts, and escalate privileges until they controlled the victim’s most sensitive systems.

The Arrests

On Thursday, U.K. national Thalha Jubair, 19, was arrested in London and charged by U.S. prosecutors with computer fraud, wire fraud, and money laundering conspiracies. He now faces up to 95 years in prison if convicted.

Investigators tied him to servers that hosted stolen data, ransom negotiations, and cryptocurrency wallets holding millions. One such wallet alone contained $36 million, seized by U.S. authorities last year.

Jubair appeared alongside 18-year-old Owen Flowers, already accused of involvement in the 2024 Transport for London cyberattack. The timing of both arrests suggests growing international coordination against Scattered Spider — with the FBI, U.K. National Crime Agency, West Midlands Police, City of London Police, and partners in Canada, Romania, Australia, and the Netherlands all participating.

Breaching the U.S. Courts

Perhaps the most alarming revelation in the complaint is that Scattered Spider penetrated the network of the U.S. Courts.

• On January 8, 2024, Jubair allegedly called the court helpdesk, posing as staff to reset passwords.
• Once inside, he compromised two accounts and exfiltrated personnel data, including names, usernames, and phone numbers.
• He then gained access to three additional accounts, one belonging to a federal judge.
• Prosecutors say he searched the judge’s inbox for subpoenas against himself and Scattered Spider.

The attack didn’t stop there. Using compromised accounts, conspirators attempted to access another magistrate’s account linked to prior cases involving group members, and even sent a fraudulent request to a financial services firm asking for emergency disclosure of customer data.

Stolen data later surfaced on Jubair’s servers — including thousands of names, titles, and work locations of court personnel.

Digital Breadcrumbs: From Telegram to Takeout

For all the group’s sophistication, investigators exploited their mistakes. Evidence included:

• Telegram chats under handles like “Brad,” “autistic,” and “EarthtoStar” where members openly discussed ransoms and division of funds.
• IP addresses from these chats that matched logins to gaming accounts registered to Jubair.
• Cryptocurrency wallets traced through gift cards used for food deliveries to Jubair’s London apartment.
• Conversations where Jubair mentioned his birthday, providing investigators with clues to confirm his identity.

Even within Scattered Spider’s culture of bravado, operational security often crumbled under the weight of everyday conveniences.

A Global Pattern

The DOJ’s case highlights just how far the group’s reach extended:

• One victim company paid $36.2 million.
• Another sent $25 million to the group.
• Dozens of others made smaller payments, often under duress.

The FBI, tracing funds and server logs, documented how ransom proceeds were laundered through crypto wallets, gaming platforms, and consumer purchases.

Scattered Spider itself is showing signs of strain. Last week, the group abandoned its public Telegram channel, with members hinting at “recent arrests” and law enforcement pressure.

TRJ Verdict

The Scattered Spider saga has crossed a line: what began as a spree of corporate ransom attacks has escalated into direct intrusions against the judicial branch of the U.S. government. By seeking out subpoenas in a judge’s inbox, the group demonstrated that its motives aren’t purely financial — they’re also defensive, self-aware, and dangerously emboldened.

The $115 million tally is not just a measure of theft, but a signal of how vulnerable critical systems remain to social engineering. If the U.S. Courts can be breached with a phone call, the question isn’t whether we’ll see more attacks — it’s how far adversaries are willing to go once inside.

Support truth, health, and preparedness by shopping the Alex Jones Store through our link. Every purchase helps sustain independent voices and earns us a 10% share to fuel our mission. Shop now and make a difference!

https://thealexjonesstore.com?sca_ref=7730615.EU54Mw6oyLATer7a

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE