UK Arrested 2 Scattered Spider Hackers Linked to London Transport System Breach

UK law enforcement has arrested two individuals linked to the notorious Scattered Spider cybercriminal group, including 19-year-old Thalha Jubair from London, who faces charges in connection with over 120 network intrusions that resulted in more than $115 million in ransom payments. 

The arrests represent a significant breakthrough in dismantling one of the world’s most prolific ransomware operations, which targeted critical infrastructure, including the London Transport system.

“Scattered Spider” Hackers Charged

The coordinated operation involved multiple international agencies, with the FBI’s Cyber Division, the UK’s National Crime Agency, the City of London Police, and the West Midlands Police working together to track down the cybercriminals. 

Jubair, operating under aliases including “EarthtoStar,” “Brad,” “Austin,” and “@autistic,” was charged with computer fraud conspiracy, wire fraud conspiracy, and money laundering conspiracy in a complaint filed in the District of New Jersey.

The investigation revealed that Scattered Spider, also known as “Octo Tempest,” “UNC3944,” and “0ktapus,” employed sophisticated social engineering techniques to infiltrate corporate networks. 

The group’s modus operandi included voice phishing attacks against help desks, SIM swapping operations, and spear phishing campaigns to gain unauthorized access to victim systems.

The cybercriminal operation spanned from May 2022 to September 2025, with attackers utilizing advanced persistence mechanisms and lateral movement techniques within compromised networks. 

Law enforcement successfully seized cryptocurrency worth approximately $36 million from servers controlled by Jubair, though he managed to transfer an additional $8.4 million in cryptocurrency to alternative wallets during the seizure operation.

The group’s targeting of critical infrastructure included successful breaches of the U.S. Courts system and a U.S.-based critical infrastructure company in October 2024 and January 2025. 

The London Transport system breach demonstrates the group’s capability to compromise SCADA systems and operational technology networks that control essential public services.

Assistant Deputy Chief Adrienne L. Rose from the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) emphasized that since 2020, CCIPS has secured convictions of over 180 cybercriminals and facilitated the return of more than $350 million in victim funds. 

If convicted on all charges, Jubair faces a maximum penalty of 95 years in prison, highlighting the severe consequences for ransomware-as-a-service operators and their affiliates.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.