Noah Michael Urban, a 20-year-old individual known for his involvement in the Scattered Spider cybercrime group, has recently pleaded guilty to various charges and potentially faces a significant amount of time in prison. Urban was one of five individuals associated with Scattered Spider who were indicted in November 2024 for their alleged roles in several cyberattacks, many of which utilized the group’s typical method of SIM-swapping.
The indictment against Urban was unsealed in California, but he had previously been indicted alone in Florida, where he resided in Palm Beach. Following his guilty plea, the charges from both indictments will be consolidated and he will be sentenced by a court in Florida at a later date.
Urban admitted guilt to two counts of wire fraud and one count of aggravated identity theft in Florida, as well as one count of wire fraud from the California indictment. Each wire fraud charge carries a maximum sentence of 20 years in prison, while the aggravated identity theft charge carries a minimum of two years. In addition to the prison time, Urban will also face a fine of at least $1 million.
In terms of restitution, Urban has agreed to pay back over $13.2 million to 59 victims. This includes organizations and individuals from whom he stole a total of $3.5 million between August 2022 and March 2023, either by himself or with the help of other members of Scattered Spider. Additionally, the authorities confiscated over $3 million worth of cryptocurrencies, cash, jewelry, and watches from Urban’s residence following his arrest in January 2024.
During the raid of Urban’s Airbnb residence, law enforcement officers found incriminating evidence on his computer, including passwords of his victims and wallet credentials used in the thefts. They also discovered that Urban had been using VPNs to conceal his activities but had failed to delete his browser history, providing a timeline of his unauthorized access to victims’ accounts.
Urban is alleged to be part of the Scattered Spider group, known for their proficiency in SIM swapping to gain access to individuals’ accounts. This technique involves convincing mobile carrier support staff to transfer a phone number to a SIM card controlled by the criminal, allowing them to intercept authentication codes and access accounts.
The charges against Urban relate to activities between August 2022 and March 2023. While the California indictment implicates other suspected members of the gang, it does not directly link any of them to specific ransomware attacks. However, Scattered Spider members are suspected of being behind attacks on MGM Resorts, Caesars Entertainment, and Okta.
In a plea document submitted by Urban, it is stated that his involvement pre-dated these high-profile attacks linked to Scattered Spider. The other individuals named in the California indictment are Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, Joel Martin Evans, and Tyler Robert Buchanan, who reside in various locations in the US and UK.
Overall, Urban’s guilty plea and the associated legal proceedings shed light on the activities of the Scattered Spider group and the impact of cybercrime on organizations and individuals. Urban’s future now hinges on the outcome of his sentencing in Florida, where he will face the consequences of his criminal actions.