The Department of Justice (DoJ) revealed today that criminal charges have been brought against five individuals connected to the cybercriminal group known as “Scattered Spider.” This group has gained notoriety for recruiting young individuals to carry out cyberattacks, including high-profile incidents such as the attacks on MGM Resorts and Caesar’s Palace in Las Vegas last year.
According to reports, the defendants targeted employees of various companies across the United States through phishing messages. By obtaining employee credentials, the group was able to access systems and steal sensitive company data, including intellectual property and personal identifying information like account credentials, names, email addresses, and telephone numbers. Additionally, the indictment alleges that the group also gained unauthorized access to cryptocurrency accounts and wallets, resulting in the theft of millions of dollars worth of virtual currency.
Of the five defendants, four are American individuals between the ages of 20 and 25. The eldest, Joel Martin Evans, also known as “joeleoli,” from Jacksonville, N.C., appeared in court after his recent arrest by the FBI. All four Americans are facing charges of conspiracy to commit wire fraud, conspiracy, and aggravated identity theft.
The fifth individual, Tyler Robert Buchanan, 22, is located in the United Kingdom and is facing charges of conspiracy to commit wire fraud, conspiracy, wire fraud, and aggravated identity theft.
In response to the unsealing of these criminal charges, Charles Carmakal, the Mandiant Consulting CTO at Google Cloud, emphasized the harm caused by these individuals and their collaborators. He stated, “These individuals, and other actors that they have collaborated with, have caused so much pain and financial harm to organizations across North America through their disruptive intrusions. We hope this sends a message to the other actors they collaborate with that they aren’t immune to consequences.”
If convicted, each defendant could potentially face significant prison sentences. The statutory maximum sentence for conspiracy to commit wire fraud is 20 years, up to five years for conspiracy, and two years for aggravated identity theft. Buchanan could face an additional 20 years for the wire fraud charge.
The charges against the members of “Scattered Spider” serve as a stark reminder of the serious consequences individuals face for engaging in cybercriminal activities. The DoJ’s actions in this case highlight the ongoing efforts to combat cyber threats and protect organizations from malicious actors in the digital landscape.