A recent court filing details how U.S. prosecutors have linked a suspected hacker from the Scattered Spider group to a cyberattack on a prestigious jewelry retailer. This connection was made possible through a persistent Windows device ID, as revealed in a newly unsealed federal complaint.
Linking the Device to the Crime
Records from Microsoft tied the device ID to an account used to maintain access during the May 2025 intrusion. Prosecutors allege that this account belongs to 19-year-old Peter Stokes, charged with conspiracy, computer intrusion, and fraud. Stokes, a dual citizen of the U.S. and Estonia known online as ‘Bouquet,’ was extradited from Finland and appeared in a Chicago court on June 30.
Details of the Security Breach
The attack took place between May 12 and 15, 2025, when perpetrators impersonated locked-out employees using Google Voice numbers. They contacted the retailer’s IT help desk, convincing staff to reset passwords and devices linked to multifactor authentication. This granted them control over three accounts, including two from IT administrators.
Subsequently, the attackers installed the tools ngrok and Teleport, transferring at least 77 gigabytes of data to Amazon cloud storage. Although an attempted ransomware deployment was thwarted by the retailer’s security team, a ransom demand for $8 million in cryptocurrency was still issued. The breach caused approximately $2 million in damages despite the company not paying the ransom.
Tracing the Attacker
Investigators traced the attack back to Stokes through the device that opened the ngrok account. Microsoft informed the FBI that the Global Device Identifier, g:6755467234350028, is a persistent identifier linked to a single Windows installation. This identifier surfaced at the time the ngrok account was created and matched activity on the retailer’s website.
Furthermore, the device was associated with Snapchat, Apple, and Facebook accounts linked to Stokes, with activity traced to various locations, including Tallinn, New York, and Thailand. Despite utilizing a VPN proxy and aliases, Stokes is alleged to have flaunted his activities and travels on social media.
Implications of the Arrest
While this arrest ties a single operator to the attack, it may not significantly impact the broader threat. Research by Group-IB indicates that Scattered Spider is not a singular group but a collective of small, independent cells. This structure resembles the Anonymous movement, suggesting that even multiple arrests may not eliminate the threat entirely.
Prosecutors allege that Scattered Spider is responsible for over 100 intrusions and more than $100 million in ransoms. However, Group-IB argues that the decentralized nature of these cells allows for continued activity despite arrests.
Continuing Investigations
Other cases linked to Scattered Spider have followed a similar pattern, with individuals being arrested one by one while the group’s methods remain intact. For example, in April 2026, Tyler Buchanan, a Scottish national, pleaded guilty to fraud and identity theft linked to the group. Similarly, other members have faced charges in connection with significant hacks like the Transport for London breach.
When Finnish authorities apprehended Stokes at Helsinki airport, they seized critical evidence, including two 2-terabyte hard drives. Such material may prove vital in dismantling the network, potentially revealing tools, infrastructure, or contacts necessary to reach additional members.
