CyberHappenings logo
☰

Scattered Spider member sentenced for SIM swapping and cryptocurrency theft

First reported
Last updated
📰 3 unique sources, 3 articles

Summary

Hide ▲

Noah Michael Urban, a 20-year-old member of the Scattered Spider cybercrime gang, has been sentenced to ten years in prison and ordered to pay $13 million in restitution. Urban pleaded guilty in April 2025 to charges related to wire fraud, conspiracy to commit wire fraud, and aggravated identity theft, which involved SIM swapping attacks to steal cryptocurrency. The sentencing follows Urban's arrest in January 2024 for crimes committed between August 2022 and March 2023. Urban's actions resulted in the theft of at least $800,000 from five victims. Urban, known by aliases such as Sosa, King Bob, Gustavo Fring, and Elijah, was part of a broader group that targeted corporate networks and stole proprietary data. Scattered Spider has been linked to social engineering, credential theft, and SIM swapping, and has recently formed alliances with other threat groups, including ShinyHunters and LAPSUS$. The group has also partnered with ransomware operations such as Qilin, RansomHub, and DragonForce, and has targeted high-profile organizations including Twilio, Coinbase, DoorDash, Caesars, MailChimp, Riot Games, and Reddit. Scattered Spider has also shifted focus to the aviation and transportation industries. The losses caused by Urban's actions exceed $13 million.

Timeline

  1. 21.08.2025 11:34 📰 1 articles

    Scattered Spider's expanded operations and alliances

    Scattered Spider, also known as 0ktapus, Scatter Swine, UNC3944, and Muddled Libra, has been involved in sophisticated social engineering attacks targeting high-profile organizations worldwide. The group has used a wide range of tactics, including phishing, SIM swapping, and multi-factor authentication (MFA) bombing. In September 2023, Scattered Spider breached MGM Resorts, encrypting over 100 VMware ESXi hypervisors using BlackCat ransomware. The group has also partnered with ransomware operations such as Qilin, RansomHub, and DragonForce. High-profile organizations targeted by Scattered Spider in recent years include Twilio, Coinbase, DoorDash, Caesars, MailChimp, Riot Games, and Reddit. More recently, the threat actors have shifted their focus from targeting retail and insurance companies to the aviation and transportation industries.

    Show sources
  2. 21.08.2025 09:45 📰 3 articles

    Scattered Spider member sentenced for SIM swapping and cryptocurrency theft

    Noah Michael Urban, a 20-year-old member of the Scattered Spider cybercrime gang, was sentenced to ten years in prison and ordered to pay $13 million in restitution. Urban pleaded guilty to wire fraud, conspiracy to commit wire fraud, and aggravated identity theft charges in April 2025. The sentencing follows Urban's arrest in January 2024 for crimes committed between August 2022 and March 2023. Urban's actions resulted in the theft of at least $800,000 from five victims. The sentencing highlights the ongoing activities of Scattered Spider, which has been linked to social engineering, credential theft, and SIM swapping. The group has recently formed alliances with other threat groups, including ShinyHunters and LAPSUS$, and targets corporate networks to steal proprietary data. New details include Urban's aliases, the extent of his cryptocurrency theft, and his involvement in the theft of confidential data from hacked companies. The article also details Scattered Spider's recent activities, including their breach of MGM Resorts and their partnerships with other ransomware operations. Additionally, the article mentions Scattered Spider's shift in focus to the aviation and transportation industries. Urban was known by the alias 'King Bob' within the Scattered Spider collective. He was sentenced to 10 years in prison plus three years of supervised release and ordered to pay $13 million in restitution to more than 30 victims. The losses caused by Urban's actions exceed $13 million. Urban was accused of stealing around $800,000 in cryptocurrency from five victims in less than a year.

    Show sources

Information Snippets