Windows Device ID Helped Authorities Track Scattered Spider Hacking Group Member

Authorities used a persistent Windows Global Device ID, along with VPN telemetry and cloud service records, to connect the infrastructure used in a major extortion attack to a 19-year-old member of the Scattered Spider group, Peter Stokes.

In a superseding criminal complaint filed in the Northern District of Illinois, the FBI outlines how Stokes, who is also known by the monikers “Bouquet,” “Spencer,” and “Jordan,” allegedly participated in over 100 intrusions that generated more than $100 million in ransom payments and caused millions more in damages as part of the Scattered Spider/Octo Tempest group.

Investigators report that Stokes opened and controlled key infrastructure accounts used in a May 2025 intrusion against “Company F,” a multinational luxury jewelry retailer. During this attack, the perpetrators stole at least 77 GB of sensitive data and demanded $8 million in cryptocurrency.

Authorities Track Scattered Spider Hacking Member

According to the affidavit, the attackers first socially engineered Company F’s IT help desk using Google Voice numbers to reset passwords and multi-factor authentication devices for three employees, including two administrators.

This access allowed them to pivot to high-privilege accounts, gain control of virtual servers in a New Jersey data center, and deploy tools such as ngrok and Teleport.sh to establish encrypted tunnels that bypassed perimeter defenses, enabling significant data exfiltration to Amazon S3 storage.

Ngrok logs indicate the threat actors moved approximately 99.5 MB of tools into the network and exfiltrated over 1.27 GB of data during the initial stages of the breach. The FBI assesses this activity as reconnaissance, credential theft, privilege escalation, and lateral movement.

The turning point in the investigation occurred when Microsoft correlated the ngrok account used in the Company F intrusion with a specific Windows Global Device ID (GDID), a unique identifier assigned to Windows devices at the installation level.

Microsoft telemetry indicated that the same GDID accessed ngrok’s signup page from a VPN IP address hosted by Tzulo, ending in .168, at the exact time the ngrok account for the Company F attack was created.

Within hours, the GDID also visited Company F’s public website via that proxy. Further analysis revealed that the GDID shared IP addresses over multiple dates with accounts from Apple, Snapchat, Facebook, and gaming services already linked to Stokes, including logins from Estonia, New York, and Thailand that corresponded with his travel records and social media posts.

Microsoft’s referrals, combined with records from Snapchat, Ubisoft, Google, and a VPN provider, allowed investigators to construct a coherent picture of a Windows installation behind what appeared to be disposable infrastructure.

Despite Scattered Spider’s use of VPN proxy services, virtual machines, cloud storage, and social engineering techniques to conceal their activities, the stable GDID linked these transient IP addresses and accounts to a single operator.

This connection, along with exfiltrated data from Company F found on a dedicated server already associated with Scattered Spider operations, ultimately provided sufficient evidence to establish that Stokes was the user of the device responsible for creating the tunnels and managing the data theft and ransom negotiations.

The complaint emphasizes how endpoint-level identifiers embedded in modern operating systems are becoming critical tools for attributing complex cybercrimes.

For defenders, this case highlights the importance of monitoring remote tunneling utilities, enforcing strict help-desk verification for multi-factor authentication resets, and recognizing that even heavily proxied threat activities can still be traced when device-centric telemetry is available to investigators.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN