{"id":59366,"date":"2025-09-18T13:00:12","date_gmt":"2025-09-18T13:00:12","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/"},"modified":"2025-09-18T13:00:12","modified_gmt":"2025-09-18T13:00:12","slug":"two-scattered-spider-teens-charged-over-attack-on-londons-transport-network","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/","title":{"rendered":"Two &#8216;Scattered Spider&#8217; teens charged over attack on London\u2019s transport network"},"content":{"rendered":"<p>Two teenagers are set to appear in court today after being charged with offences related to the cyberattack on Transport for London (TfL) in August 2024.<\/p>\n<div class=\"promo_article\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/regmedia.co.uk\/2017\/05\/18\/secret_service_shutterstock1.jpg?x=174&amp;amp;y=115&amp;amp;crop=1\" width=\"174\" height=\"115\" alt=\"Secret Service\"><\/p>\n<h2 title=\"Unimpressed beak orders Transport for London to let them onto Southwark roof\">EE and Three mobe mast surveyors might &#8216;upload some virus&#8217; to London Tube control centre, TfL told judge<\/h2>\n<p><a href=\"https:\/\/www.theregister.com\/2021\/06\/09\/mobile_mast_surveyors_virus_upload_silliness\/\"><span>READ MORE<\/span><\/a><\/div>\n<p>Owen Flowers, 18, from Walsall, was arrested for the second time this week, having previously been arrested and questioned in connection with the attack.<\/p>\n<p>Flowers, who can now be named since turning 18 years of age, is alleged to have acted alongside another suspect, Thalha Jubair, 19, from East London, and other unknown individuals, to carry out the attack that caused widespread disruption for users of London&#8217;s transport network last year.<\/p>\n<p>Both Flowers and Jubair were arrested at their homes at around lunchtime, in quick succession, on September 16, the National Crime Agency (NCA) said, which worked to secure charges against the pair on Wednesday, alongside City of London Police.<\/p>\n<p>From there, they were held in different custody blocks and interviewed, including questioning related to offences separate from the TfL attack.&nbsp;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,dmpu,\" data-sm=\",fluid,mpu,dmpu,\" data-md=\",fluid,mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Flowers and Jubair will appear at Westminster Magistrates&#8217; Court today. The hearing will determine whether they are bailed or remanded in custody.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>The Crown Prosecution Service (CPS) authorized the charges against the two young men on Wednesday, most of which fall under the Computer Misuse Act.&nbsp;<\/p>\n<p>Regarding TfL, Flowers and Jubair were both charged with conspiracy to commit an unauthorized act in relation to a computer causing\/creating risk of serious damage to human welfare\/national security.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,dmpu,\" data-sm=\",fluid,mpu,dmpu,\" data-md=\",fluid,mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Both face separate, additional charges.<\/p>\n<p>Flowers was also accused of being connected to two other attacks on US healthcare organizations around the same time as the TfL hit \u2013 one on SSM Health Care Corporation and the other on Sutter Health.<\/p>\n<p>The NCA said that Flowers was charged for infiltrating and damaging SSM&#8217;s network, and attempting to do the same with Sutter Health.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aMwPe-na6a-t6uTcsb0v0wAAAQE&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>Aside from TfL, Jubair also faces a charge under the Regulation of Investigatory Powers Act 2000, for failing to surrender PINs and passwords for devices seized by law enforcement on March 19.<\/p>\n<p>Deputy Director Paul Foster, head of the NCA&#8217;s National Cyber Crime Unit, told journalists ahead of the hearing that the hope and main objective for these charges is to ensure a sustained disruptive effect against these two individuals and their alleged cyber offences.<\/p>\n<p>In a public statement, he said: &#8220;Today&#8217;s charges are a key step in what has been a lengthy and complex investigation.<\/p>\n<p>&#8220;This attack caused significant disruption and millions in losses to TfL, part of the UK&#8217;s critical national infrastructure.&nbsp;<\/p>\n<p>&#8220;Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.<\/p>\n<p>&#8220;The NCA, UK policing, and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.&#8221;<\/p>\n<p>Hannah Von Dadelszen, chief crown prosecutor at the CPS, said: &#8220;Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.<\/p>\n<p>&#8220;We have worked closely with the National Crime Agency as they carried out their investigation.&#8221;<\/p>\n<p>Whether Flowers and\/or Jubair will be bailed or remanded in custody will be determined by today&#8217;s hearing.<\/p>\n<h3 class=\"crosshead\">Nabbed Spiders<\/h3>\n<p>It can be revealed today that both Flowers and Jubair are alleged by UK authorities to be members of the cybercrime group known as Scattered Spider.<\/p>\n<p>The evidential threshold for attributing individuals to groups, and those groups to specific attacks, is extremely high across law enforcement and the cybersecurity industry, making the revelation ever more notable.<\/p>\n<p>Despite Scattered Spider being linked to various high-profile attacks, neither Flowers nor Jubair are currently officially linked by authorities to the attacks on British retail giants <a href=\"https:\/\/www.theregister.com\/2025\/08\/11\/ms_restores_click_collect_following\/\">M&amp;S<\/a>, <a href=\"https:\/\/www.theregister.com\/2025\/07\/16\/coop_data_stolen\/\">Co-op<\/a>, and <a href=\"https:\/\/www.theregister.com\/2025\/05\/02\/ncsc_steps_in_as_harrods\/\">Harrods<\/a> earlier this year.<\/p>\n<p><em>The Register<\/em> reported in two separate stories last year, concerning the attacks on <a href=\"https:\/\/www.theregister.com\/2024\/07\/19\/uk_mgm_suspect_arrested\/\">US MGM Casinos<\/a> and <a href=\"https:\/\/www.theregister.com\/2024\/09\/12\/transport_for_londons_cyber_attack\/\">TfL<\/a>, that in both cases a 17-year-old from Walsall was arrested on suspicion of their involvement.&nbsp;<\/p>\n<p>Despite Flowers matching that description, it&#8217;s understood that he is not officially being linked to the MGM case, although today it can be revealed he was charged for the TfL attack, and separate investigations remain ongoing.<\/p>\n<p>When asked, the NCA did not provide an update on its investigation into the ongoing cyberattack on <a href=\"https:\/\/www.theregister.com\/2025\/09\/16\/jlr_global_shutdown\/\">Jaguar Land Rover<\/a>, despite the widespread allegations of links between the attack and Scattered Lapsus$ Hunters.<\/p>\n<h3 class=\"crosshead\">TfL recap<\/h3>\n<p>The attack on TfL occurred on August 31, 2024, and although the very worst possible consequence \u2013 disruption to the smooth running of public transport \u2013 was averted, the overall impact on the organization was severe.<\/p>\n<p>Various back office functions were rendered unavailable, and in the early days of the attack some staff were told to work from home.<\/p>\n<p>Limited numbers of ticketing machines at London Underground stations went offline, and users relying on contactless payments to access transport services were unable to view their journey histories online.<\/p>\n<p>It was not until December 4, 2024, that TfL was able to issue photo travel cards \u2013 Zip cards for young people, and Oyster cards for the 18+ and 60+ age groups \u2013 or issue refunds to customers for incomplete pay-as-you-go journeys.<\/p>\n<p>The refund and bank data of around 5,000 Oyster cardholders was also exposed, with the info potentially including bank account numbers and sort codes.<\/p>\n<p><em>The Register<\/em> reported at the time that a large portion of TfL&#8217;s IT infrastructure was pulled offline, which in turn affected the availability of live Tube arrival information from being displayed at platforms.<\/p>\n<p>According to annual reports from London&#8217;s transport authority, the total costs related to the incident, including incident response and remediation measures, ran into the tens of millions.<\/p>\n<p>A TfL spokesperson said: &#8220;We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year, and continue to support them with their ongoing law enforcement investigation.&nbsp;<\/p>\n<p>&#8220;The security of our systems and customer data is extremely important to us. We continually monitor our systems to ensure only those authorised can gain access and continue to take the necessary actions to protect TfL.&#8221; \u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2025\/09\/18\/two_teens_charged_in_tfl_case\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Decisive action comes nearly a year after the attack and first arrest took place Two teenagers are set to appear in court today after being charged with offences related to the cyberattack on Transport for London (TfL) in August 2024.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":59367,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-59366","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Two &#039;Scattered Spider&#039; teens charged over attack on London\u2019s transport network 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Two &#039;Scattered Spider&#039; teens charged over attack on London\u2019s transport network 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-18T13:00:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/regmedia.co.uk\/2017\/05\/18\/secret_service_shutterstock1.jpg?x=174&amp;amp;y=115&amp;amp;crop=1\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Two &#8216;Scattered Spider&#8217; teens charged over attack on London\u2019s transport network\",\"datePublished\":\"2025-09-18T13:00:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/\"},\"wordCount\":1059,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/\",\"name\":\"Two 'Scattered Spider' teens charged over attack on London\u2019s transport network 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg\",\"datePublished\":\"2025-09-18T13:00:12+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/09\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg\",\"width\":174,\"height\":115},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Two &#8216;Scattered Spider&#8217; teens charged over attack on London\u2019s transport network\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Two 'Scattered Spider' teens charged over attack on London\u2019s transport network 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/","og_locale":"en_US","og_type":"article","og_title":"Two 'Scattered Spider' teens charged over attack on London\u2019s transport network 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2025-09-18T13:00:12+00:00","og_image":[{"url":"https:\/\/regmedia.co.uk\/2017\/05\/18\/secret_service_shutterstock1.jpg?x=174&amp;amp;y=115&amp;amp;crop=1","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Two &#8216;Scattered Spider&#8217; teens charged over attack on London\u2019s transport network","datePublished":"2025-09-18T13:00:12+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/"},"wordCount":1059,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/09\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/","url":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/","name":"Two 'Scattered Spider' teens charged over attack on London\u2019s transport network 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/09\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg","datePublished":"2025-09-18T13:00:12+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/09\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/09\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network.jpg","width":174,"height":115},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/two-scattered-spider-teens-charged-over-attack-on-londons-transport-network\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Two &#8216;Scattered Spider&#8217; teens charged over attack on London\u2019s transport network"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=59366"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59366\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/59367"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=59366"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=59366"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=59366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}