Scattered Spider Hacker Arrested in Finland and Extradited to U.S. Over Cyber Intrusion Charges

U.S. authorities have announced federal charges against an alleged member of the notorious cybercriminal group Scattered Spider, following his arrest in Finland and extradition to the United States.

The defendant, identified as 19-year-old Peter Stokes, a dual national of the U.S. and Estonia, is accused of participating in a widespread conspiracy involving cyber intrusions and extortion that targeted major organizations across the United States.

Scattered Spider Hacker Arrested

According to the Department of Justice (DOJ), Stokes was apprehended by Finnish authorities in April 2026 based on an Interpol Red Notice. He was extradited to the United States last week.

He made his initial court appearance in the Northern District of Illinois, where he has been ordered to remain in custody pending further proceedings. The criminal complaint charges him with conspiracy, computer intrusion, and fraud-related offenses tied to his alleged role in Scattered Spider operations.

Scattered Spider, also tracked as “Octo Tempest,” “UNC3944,” and “0ktapus,” has emerged as one of the most disruptive financially motivated cyber threat groups in recent years.

The group is known for targeting enterprise environments through sophisticated social engineering campaigns, including impersonating IT support personnel and using SIM-swapping to bypass multi-factor authentication (MFA).

Once initial access is gained, attackers typically move laterally across networks, exfiltrate sensitive data, and deploy ransomware or extortion tactics to coerce victims into paying large cryptocurrency ransoms.

Federal prosecutors allege that the group has been responsible for over 100 network intrusions, generating more than $100 million in ransom payments while inflicting millions more in operational damages.

In one highlighted incident from May 2025, Stokes and co-conspirators allegedly breached a luxury jewelry retailer’s network, exfiltrated sensitive corporate data, and issued a ransom demand of approximately $8 million in cryptocurrency.

Although the company successfully contained the intrusion and refused to pay, it reportedly incurred at least $2 million in losses due to business disruption, forensic investigations, and remediation efforts.

The investigation was led by the FBI Chicago Field Office, with international assistance from the FBI’s Copenhagen Legal Attaché and Finland’s National Bureau of Investigation.

The DOJ’s Office of International Affairs coordinated the extradition process, underscoring the increasing reliance on cross-border law enforcement collaboration to combat cybercrime. The case is being prosecuted by attorneys from the DOJ’s Computer Crime and Intellectual Property Section (CCIPS) alongside federal prosecutors in Illinois.

Officials emphasized that the arrest forms part of “Operation Riptide,” an ongoing FBI initiative aimed at dismantling cybercriminal ecosystems, including infrastructure, financial channels, and affiliated threat actors.

The operation comes amid a sharp rise in cybercrime-related losses, with Americans reporting more than $20 billion in damages in the past year alone, a 26% year-over-year increase.

Law enforcement agencies reiterated that cybercriminals operating across international jurisdictions will continue to face coordinated enforcement actions. The DOJ noted that charges outlined in the complaint remain allegations, and Stokes is presumed innocent until proven guilty in a court of law.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN