The US Department of Justice and the FBI collaborated with the National Research Agency of Finland to arrest a teenager who they say is a member of one of the largest gangs in cyberspace. The gang “Scattered Spider” has managed to extort over $100 million in ransom, according to data from the Department of Justice:
Peter Stokes, 19, is a dual US-Estonian citizen who was trying to board a flight to Japan from Helsinki when he was caught by authorities. The main charge against Stokes stems from a May 2025 attack on a US-based luxury jewelry retailer. The attackers called the company’s IT support desk using Google Voice, impersonating employees. They managed to convince the support desk to reset their credentials, which allowed them to infiltrate three accounts, two of which had administrator rights. From there, the group, which Stokes allegedly also belongs to, stole important data and demanded a ransom of $8 million in cryptocurrency.
The company eventually regained access to its infrastructure and avoided paying the ransom, but the site outage caused an estimated $2 million in losses. This led to Stokes' arrest in Helsinki as prosecutors pursued the attackers both physically and digitally.
Microsoft played a key role in the process by providing GDID [Global Device Identifier] data to the FBI to help them arrest Stokes…
This is a unique identifier assigned to each Windows installation and tracks specific devices with telemetry. This is why sometimes changing a major component on your computer can revoke your Windows license…
Court documents from the case reveal that Stokes used Windows, from which investigators were able to link his hardware to specific internet activity and locations… Stokes’ internet activity, video game history, IP addresses, tool usage (including Ngrok), Azure status and more were recorded with timestamps and provided to investigators by Microsoft…
Ngrok is a useful tool for developers and technicians, which allows access to a local application (localhost) over the internet. It creates a secure tunnel, bypassing complicated router or firewall settings.
Stokes carried two hard drives full of incriminating evidence with him when he boarded his flight to Japan… His real identity had been known since 2024, but because he was a minor living in Estonia and the UAE at the time, he could only be monitored until the right time came.
Η a formal complaint includes even a selfie that Stokes posted on Snapchat (hiding his face behind dozens of hundred-dollar bills). The complaint then says that behind Stokes the wallpaper, carpet and furniture match the Empire Hotel in New York City — and that Stokes had visited the hotel’s website from Germany before flying to New York…
Although the press releases will range from very select to rare, I said I'd pass...because sometimes the editors hide.
