Executive Overview
The sprawling, high-stakes international dragnet targeting Scattered Spider—arguably one of the most disruptive and elusive cybercrime syndicates of the modern digital era—has reached a defining legal milestone. In a British courtroom this week, two core members of the syndicate entered guilty pleas on the opening day of what was projected to be a grueling, six-week trial.
The defendants, Thalha Jubair, 20, of East London, and Owen Flowers, 18, of Walsall, admitted to a litany of severe criminal offenses stemming from an audacious August 2024 cyberattack that brought Transport for London (TfL)—the public transit authority governing the Greater London metropolitan area—to its knees. Beyond the TfL incident, both young men acknowledged extensive involvement in a transnational web of corporate extortion, sophisticated infrastructure compromises, and multi-million-dollar ransomware campaigns targeting critical infrastructure, massive retail chains, and healthcare systems across both sides of the Atlantic.
The guilty pleas represent a watershed moment for law enforcement agencies globally, including the United Kingdom’s National Crime Agency (NCA) and the U.S. Department of Justice (DOJ). Scattered Spider has long confounded cybersecurity analysts and federal investigators due to its unusual demographic profile—frequently comprising digital natives adept at social engineering, SIM-swapping, and corporate espionage—and its brazen operational tactics. With Jubair and Flowers now facing sentencing on July 15, 2026, the walls are closing in on an enterprise that law enforcement estimates has extorted at least $115 million from victim organizations worldwide.
Detailed Chronology: From Digital Extortion to the Courtroom Dock
The unraveling of Jubair and Flowers’ operations is the result of years of meticulous digital forensics, international intelligence-sharing, and multi-jurisdictional sting operations. The timeline of their rise and subsequent legal collapse highlights the borderless nature of modern cybercrime.
The Summer of Phishing and Mass Breaches (2022)
Long before they paralyzed London’s transport grid, the core architecture of the group’s early enterprise was built on mass credential harvesting. U.S. prosecutors allege that Jubair, operating under online aliases such as “Rocket Ace,” was a central figure in a relentless SMS-phishing (smishing) campaign that rocked corporate America during the summer of 2022.
Targeting hundreds of companies via customized single sign-on (SSO) credential-harvesting pages, Jubair and co-conspirators—including previously convicted members like Tyler “Tylerb” Buchanan—compromised the internal networks of over 130 major organizations. This wave of attacks yielded devastating data thefts and intrusions at industry giants including LastPass, DoorDash, Mailchimp, Plex, and Signal. According to federal court filings, the credentials harvested during this specific campaign were weaponized to siphon at least $8 million in cryptocurrency from unsuspecting victims across the United States.
The Casino Heists and Retail Extortion Spree (2023–2024)
As Scattered Spider matured, its operational ambitions escalated from credential harvesting to full-scale enterprise ransomware extortion. In September 2023, the syndicate launched high-profile ransomware attacks that completely crippled operations at prominent Las Vegas entertainment and casino empires, including MGM Resorts and Caesars Entertainment.
Investigative reporting later revealed that Owen Flowers played an active role in these operations—not merely behind a keyboard, but as an audacious public-facing figure. Sources familiar with the internal investigations confirmed that Flowers was the anonymous Scattered Spider insider who granted candid media interviews in the immediate aftermath of the casino chaos, reveling in the group’s disruptive footprint.
The syndicate’s cross-border targeting soon hit British soil with equal ferocity. In July 2025, the NCA and domestic investigators formally linked Flowers and Jubair to a coordinated wave of ransomware strikes targeting premier UK retail institutions, including Marks & Spencer, Harrods, and the Co-op Group.
The TfL Crippling and U.S. Healthcare Incursions (August–September 2024)
The precipitating event for the current UK criminal trial occurred in August 2024, when a sophisticated cyberattack paralyzed Transport for London. The incident severely disrupted back-office systems, customer services, and operational workflows for the millions of commuters relying on the Greater London transport network.
Both Jubair and Flowers formally pleaded guilty this week to conspiring to commit unauthorized acts against TfL computer systems under the UK’s Computer Misuse Act, alongside charges of causing a risk of serious damage to human welfare—a severe legal threshold underscoring the vital societal dependency on public transit infrastructure. Furthermore, court disclosures revealed that Flowers admitted to an additional conspiracy charge involving successful hacks into major U.S. healthcare providers, SSM Health Care Corporation and Sutter Health, in September 2024.
Supporting Context & Metrics: The Anatomy of Scattered Spider
To fully understand the weight of the guilty pleas entered by Jubair and Flowers, one must examine the operational blueprint and financial scale of Scattered Spider. Unlike traditional state-sponsored Advanced Persistent Threat (APT) groups that rely on zero-day exploits, Scattered Spider relies heavily on human-centric engineering, insider threat recruitment, and identity manipulation.
The Star Chat SIM-Swapping Ecosystem
Central to Jubair’s illicit enterprise was his role as a co-administrator of Star Chat (also known as Star Fraud Chat), a bustling Telegram channel dedicated to SIM-swapping and cellular carrier compromise.
- The Methodology: The group utilized voice- and SMS-based social engineering to target frontline customer service employees at major telecommunications providers in both the United States and the United Kingdom.
- The Exploitation: By gaining unauthorized access to internal employee tooling, the group could seamlessly execute SIM swaps—redirecting a target’s cellular phone number to a device controlled by the hackers.
- The Impact: This granted the attackers real-time interception capabilities over victims’ phone calls and text messages, effectively bypassing multi-factor authentication (MFA) mechanisms, including one-time passcodes (OTPs) used to secure corporate environments and crypto-wallets.
"Everlynn" and Fake Emergency Data Requests
Jubair’s technical footprint extended deep into the shadows of identity fraud from a remarkably young age. Investigative reports previously exposed that Jubair operated under the alias “Everlynn” as early as age 15. In this persona, he commercialized fraudulent “Emergency Data Requests” (EDRs).
By compromising legitimate law enforcement and government email accounts, the hackers issued forged EDRs to major Silicon Valley tech giants. These fake demands falsely claimed that pending data requests concerned life-and-death emergencies that could not wait for a formal court order, tricking tech companies into handing over sensitive subscriber profiles, IP addresses, and private communications.
Scale of the Enterprise: Key Statistics and Global Fallout
The financial and operational toll extracted by Scattered Spider is staggering. According to comprehensive data released by U.S. prosecutors and international law enforcement task forces:
- $115 Million+: The minimum estimated total paid in ransom by victim organizations targeted by the group.
- 120+: The total number of confirmed computer network intrusions tied to Jubair and his co-conspirators between May 2022 and September 2025.
- 47: The specific number of distinct U.S. corporate and institutional entities victimized during this primary indictment window.
- 10 Years: The federal prison sentence handed down in August 2025 to 20-year-old Florida native and fellow Scattered Spider operative Noah Michael Urban, accompanied by an order for $13 million in restitution.
Official Statements and International Legal Fallout
The dismantling of Scattered Spider reflects an unprecedented level of cooperation between British law enforcement and American federal prosecutors. While Jubair and Flowers face impending sentencing in London on July 15, 2026, their legal jeopardy extends far beyond the Atlantic.
Thalha Jubair remains a prime target for U.S. law enforcement. In September 2025, the U.S. Attorney’s Office for the District of New Jersey unsealed a sweeping federal indictment charging Jubair with multiple counts of computer fraud, wire fraud, and money laundering. Extradition proceedings or subsequent U.S. federal trials remain a distinct possibility once his British penal obligations are addressed.
Meanwhile, the wider network continues to crumble under the weight of coordinated indictments:
- Tyler “Tylerb” Buchanan (24, UK national) pleaded guilty in April 2026 to wire fraud conspiracy and aggravated identity theft. His sentencing is currently slated for October 2, 2026.
- Noah Michael Urban is already serving his decade-long federal sentence following his guilty plea in 2025.
- Several co-defendants named in joint U.S. indictments—including Ahmed Hossam Eldin Elbadawy (“AD,” 24, of Texas), Evans Onyeaka Osiebo (21, of Dallas), and Joel Martin Evans (“joeleoli,” 26, of North Carolina)—still face active federal prosecution in the United States.
Law enforcement officials have hailed the cooperative investigations as a turning point in combating decentralized, youth-dominated cybercrime syndicates. By treating digital social engineering and SIM-swapping with the same legal severity as traditional organized crime, international authorities are dismantling the aura of invincibility that once surrounded groups like Scattered Spider.
Future Outlook: The End of an Era for Digital Impunity?
The guilty pleas entered by Owen Flowers and Thalha Jubair mark a critical juncture in the global fight against advanced cyber extortion. For years, syndicates operating in the grey spaces between traditional financially motivated ransomware gangs and loose-knit hacker collectives have treated multinational corporations and critical infrastructure with impunity, banking on the anonymity provided by encrypted messaging apps, cryptocurrency mixers, and cross-border jurisdictional boundaries.
However, the systematic identification, apprehension, and prosecution of core figures like Flowers, Jubair, Buchanan, and Urban signal a permanent shift in cybersecurity enforcement. Law enforcement agencies have proven that they can pierce the veils of online aliases, Telegram channels, and dark web forums.
As the British courts prepare to hand down formal sentencing on July 15, 2026, the message to the remaining cells of Scattered Spider—and to the broader cybercrime underground—is unequivocal: the digital frontier is no longer a lawless sanctuary. Corporate resilience, combined with aggressive, borderless international policing, is finally catching up with the architects of modern cyber extortion.
