{"id":59373,"date":"2025-09-19T13:02:06","date_gmt":"2025-09-19T13:02:06","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/"},"modified":"2025-09-19T13:02:06","modified_gmt":"2025-09-19T13:02:06","slug":"scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/","title":{"rendered":"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin"},"content":{"rendered":"<p>Thalha Jubair, one of the two UK teens arrested on Tuesday and accused of being members of the notorious Scattered Spider cybercrime gang, allegedly played a role in bilking more than 100 organizations out of at least $115 million in ransom payments. The cops nabbed him after following a number of clues, including paying for gift cards from a wallet on the same server that also held wallets receiving extortion payments.<\/p>\n<p><a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/08\/12\/scattered_spidershinyhunterslapsus_cybercrime_collab\/\">Scattered Spider<\/a>, a SIM-swapping turned <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/05\/18\/ex_nsa_scattered_spider_call\/\">social-engineering<\/a> and <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/05\/15\/dragonforce_ransomware_uk_retail_attacks\/\">ransomware<\/a> group, has been around since at least 2022, and saw <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/04\/08\/scattered_spider_updates\/\">at least seven<\/a> of its members arrested last year following the high-profile <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2023\/12\/28\/casino_ransomware_attacks\/\">Las Vegas casino digital heists<\/a>.<\/p>\n<p>The group has been blamed for several <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/05\/13\/ms_confirms_customer_data_stolen\/\">high-profile retail intrusions<\/a> in April, although 19-year-old Jubair of East London and 18-year-old Owen Flowers of Walsall <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/09\/18\/two_teens_charged_in_tfl_case\/\">appeared in a British court<\/a> on Thursday for their alleged roles in a <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2024\/09\/12\/transport_for_londons_cyber_attack\/\">cyberattack on Transport for London<\/a> last year.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"condor\" data-xsm=\",fluid,mpu,dmpu,\" data-sm=\",fluid,mpu,dmpu,\" data-md=\",fluid,mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>On the other side of the Atlantic, acting US Attorney Alina Habba announced criminal charges against Jubair, <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/www.justice.gov\/opa\/pr\/united-kingdom-national-charged-connection-multiple-cyber-attacks-including-critical\">saying<\/a> he &#8220;went to great and sophisticated lengths to keep himself anonymous,&#8221; while taking part in about 120 network intrusions, including at least 47 US-based organizations.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xmd=\",fluid,mpu,leaderboard,\" data-lg=\",fluid,mpu,leaderboard,\" data-xlg=\",fluid,billboard,superleaderboard,mpu,leaderboard,\" data-xxlg=\",fluid,billboard,superleaderboard,brandwidth,brandimpact,leaderboard,mpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<div class=\"adun_eagle_desktop_story_wrapper\">\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"mid\" data-raptor=\"eagle\" data-xxlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<\/p><\/div>\n<p>Jubair also allegedly made some critical mistakes that pointed to his alleged ransomware criminal activities.<\/p>\n<p>Perhaps the most incriminating: Somebody took cryptocurrency from a wallet on a server that also held ransom funds and bought gaming gift cards tied to an account in Jubair&#8217;s name, as well as food-delivery gift cards, which were then used to order takeout to the apartment complex where he lived.<\/p>\n<div aria-hidden=\"true\" class=\"adun\" data-pos=\"top\" data-raptor=\"falcon\" data-xsm=\",fluid,mpu,dmpu,\" data-sm=\",fluid,mpu,dmpu,\" data-md=\",fluid,mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=4&amp;c=44aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D426raptor%3Dfalcon%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>In <a target=\"_blank\" rel=\"nofollow\" href=\"https:\/\/regmedia.co.uk\/2025\/09\/18\/thalha_jubair_criminal_complaint.pdf\">court documents<\/a> [PDF] unsealed on Thursday, the US Justice Department charged Jubair with conspiracies to commit computer fraud, wire fraud, and money laundering related to at least 120 Scattered Spider computer network intrusions and extortion attacks between May 2022 and this month.&nbsp;<\/p>\n<h3 class=\"crosshead\">Victims include US courts<\/h3>\n<p>The criminal complaint only names one of Jubair&#8217;s victims: the United States federal court system. This digital intrusion occurred in early January, and followed a <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/07\/29\/fbi_scattered_spider_alert\/\">classic Scattered Spider playbook<\/a>:<\/p>\n<p>The digital thieves then used the stolen credentials to access accounts belonging to three users, one of whom is a federal magistrate judge, and searched the judge&#8217;s inbox for terms including &#8220;subpoena,&#8221; the name of a charged cybercriminal, and &#8220;scattered spider,&#8221; according to the complaint.<\/p>\n<p>Additionally, the crooks allegedly used one of the compromised accounts to send a message to a financial services provider requesting the emergency disclosure of customer account information.&nbsp;<\/p>\n<p>The other seven US-based victims aren&#8217;t named, but rather identified as Company-1 through Company-7. They include a manufacturer, an entertainment firm, two retailers,&nbsp;two financial services companies, and a critical infrastructure firm.<\/p>\n<p>In all of these cases, after gaining access to the companies&#8217; networks &#8211; usually via social engineering (often targeting helpdesks) and convincing them to reset another worker&#8217;s password &#8211; the crooks stole sensitive data, sometimes encrypted it, and then demanded a ransom payment for its return or decryption.&nbsp;<\/p>\n<p>In five of these intrusions, the victim company paid ransom demands totaling at least $89.5 million in bitcoin at the time of payment. In a couple of the attacks detailed in the court documents, the organization paid the extortionists two separate sums of money. The two highest ransom payouts, paid by the two financial institutions, were the bitcoin equivalent of more than $25 million and $36.2 million.<\/p>\n<p>Portions of ransom payments from at least five victims were traced to wallets on a server the FBI says Jubair controlled, and agents later seized about $36 million in cryptocurrency from wallet(s) on that server.<\/p>\n<h3 class=\"crosshead\">Incriminating messages, files, wallets<\/h3>\n<p>In July 2024, during the seizure operation, Jubair allegedly moved about $8.4 million in cryptocurrency from a wallet on that server to another wallet.<\/p>\n<p>Several documents recovered from the server plus online chats also indicate Jubair was involved in these digital break-ins.&nbsp;<\/p>\n<div aria-hidden=\"true\" class=\"adun\" id=\"story_eagle_xsm_sm_md_xmd_lg_xlg\" data-pos=\"mid\" data-raptor=\"eagle\" data-xsm=\",mpu,dmpu,\" data-sm=\",mpu,dmpu,\" data-md=\",mpu,dmpu,\" data-xmd=\",mpu,dmpu,\" data-lg=\",mpu,dmpu,\" data-xlg=\",mpu,dmpu,\"> <noscript> <a href=\"https:\/\/pubads.g.doubleclick.net\/gampad\/jump?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" target=\"_blank\"> <img decoding=\"async\" src=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=3&amp;c=33aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0\" alt> <\/a> <\/noscript> <\/div>\n<p>In October 2023, he used a Telegram account with the identifier &#8220;Brad&#8221; and the handle @autistic to discuss cyber intrusions at about 40 companies with another co-conspirator, at one point telling them that Victim Company-4&nbsp;indicated they would pay $25 million. &#8220;they&#8217;re getting the btc now,&#8221; Jubair allegedly messaged his fellow crim.<\/p>\n<p>&#8220;Later that day\u2026Victim Company-4 paid a ransom worth approximately $25 million. Shortly after that payment, JUBAIR explained that he would pay the Co-Conspirator a portion of the payments JUBAIR received from Victim Companies-3 and -4,&#8221; the court documents say.<\/p>\n<p>Additionally, a Blockchain analysis revealed that cryptocurrency contained in a wallet discovered the seized server was used to purchase two gift cards for a food delivery company:<\/p>\n<p>One of these wallets was also used to purchase five gift cards for a gaming company, and investigators found that activity linked back to a gaming account accessed using credentials registered to Jubair at his residence.<\/p>\n<p>In addition, conversations recovered from the seized server show that on April 7, 2024, someone using the moniker &#8220;Austin&#8221; &#8211; another one of Jubair&#8217;s online aliases, according to the DOJ &#8211; told another individual that he &#8220;turned 18 three weeks ago.&#8221; &#8220;The investigation has revealed that JUBAIR&#8217;s 18th birthday was approximately three weeks before this conversation,&#8221; according to the court documents.&#8221;<\/p>\n<p>Infosec analysts cheered the Thursday arrests, with CrowdStrike&#8217;s Head of Counter Adversary Operations Adam Meyers calling them &#8220;a significant blow to one of the most disruptive eCrime groups operating today.<\/p>\n<p>&#8220;This coordinated law enforcement action will likely degrade Scattered Spider&#8217;s operations in the near term,&#8221; Meyers told <i>The Register<\/i>. &#8220;More importantly, it sends a message: cybercriminals who aggressively extort and disrupt are not beyond reach. But this isn&#8217;t just about arrests \u2014 it demonstrates the impact of strong public-private collaboration \u2014 when law enforcement and industry share intelligence and act decisively, we can disrupt operations that are inflicting real damage on global businesses.&#8221;<\/p>\n<p>Jubair isn&#8217;t the first <a target=\"_blank\" href=\"https:\/\/www.theregister.com\/2025\/07\/01\/terrible_tales_of_opsec_oversights\/\">cybercrook to make dumb mistakes<\/a> that will likely cost him his freedom. Even criminals need to eat. And play online games.\u00ae<\/p>\n<p> READ MORE <a href=\"https:\/\/go.theregister.com\/feed\/www.theregister.com\/2025\/09\/19\/scattered_spider_teen_cuffed\/\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bad opsec Thalha Jubair, one of the two UK teens arrested on Tuesday and accused of being members of the notorious Scattered Spider cybercrime gang, allegedly played a role in bilking more than 100 organizations out of at least $115 million in ransom payments. The cops nabbed him after following a number of clues, including paying for gift cards from a wallet on the same server that also held wallets receiving extortion payments.\u2026 READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[63],"tags":[],"class_list":["post-59373","post","type-post","status-publish","format-standard","hentry","category-the-register"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Scattered Spider teen cuffed after buying games and meals with extortion bitcoin 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-19T13:02:06+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin\",\"datePublished\":\"2025-09-19T13:02:06+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/\"},\"wordCount\":990,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"articleSection\":[\"The Register\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/\",\"name\":\"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"datePublished\":\"2025-09-19T13:02:06+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#primaryimage\",\"url\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\",\"contentUrl\":\"https:\\\/\\\/pubads.g.doubleclick.net\\\/gampad\\\/ad?co=1&amp;iu=\\\/6978\\\/reg_security\\\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/","og_locale":"en_US","og_type":"article","og_title":"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2025-09-19T13:02:06+00:00","og_image":[{"url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin","datePublished":"2025-09-19T13:02:06+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/"},"wordCount":990,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","articleSection":["The Register"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/","url":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/","name":"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#primaryimage"},"thumbnailUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","datePublished":"2025-09-19T13:02:06+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#primaryimage","url":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0","contentUrl":"https:\/\/pubads.g.doubleclick.net\/gampad\/ad?co=1&amp;iu=\/6978\/reg_security\/cybercrime&amp;sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&amp;tile=2&amp;c=2aM1k77_HuLFsEmKtKuGiMAAAAJI&amp;t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/scattered-spider-teen-cuffed-after-buying-games-and-meals-with-extortion-bitcoin\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Scattered Spider teen cuffed after buying games and meals with extortion bitcoin"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=59373"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59373\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=59373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=59373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=59373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}