Alleged Scattered Spider teen cuffed after extortion Bitcoin used to buy games, meals Thalha Jubair, one of the two UK teens arrested on Tuesday and accused of being members of the notorious Scattered Spider cybercrime gang, allegedly played a role in bilking more than 100 organizations out of at least $115 million in ransom payments. Cops nabbed him after following a number of clues, including gift cards …
If he's committed offences here, he can be tried here for the offences.
Only after we're done with him should we even entertain an extradition request, and part of the condition of agreeing to a request should be - if found guilty in the US - that any US sentence gets tacked on the end of whatever we sentence him to, and he should serve the whole lot in a US jail to save us the prison space.
Due to the extraterritoriality of the Wire Fraud act (as a consequence of how the internet works), practically any online fraud is an offence in the US. All it takes is for one byte of traffic to flow through a US server or router and the crime has been committed.
Note that that applies even if the fraud itself took place outside of the US and defrauded non US citizens, and it the activity concerned was legal in the countries it touched (but not if they had touched the USA). Though generally it is applied only if there was an actual or potential US citizen as target of the activity.
There’s been various cases involving non US business persons that way.
In this specific case it’d be interesting to see if they’re ring leaders or foot soldiers in a bigger group.
because they're point one of contact.
outsourced
offshored
non native english speakers
shit job so they don't stay long enough to get to know actual customers
SLA is on closed calls so they'll just take the £1/day & reset whatever passwords they're told to
genuinely ZERO sympathy of any of the firms screwed by this.
back in the day, the hell desk would be in the same building or at least close. you'd know them & at the very least meet them at the xmas party. they could wander over and ask for help, learn stuff & could become 2nd line & move up the ladder.
Got no sympathy for firms broken into like this & don't blame the helldesk agents for just resetting whatever they're told to
I though oh maybe the FBI managed to compromise their chats or someone made some slight error which meant they were able to trace their IP, But no!
He had access to $8m in crypto yet chose to spend it on food delivery apps to his own place and buy online gaming gift card and use them with his real account. And all when being located in a country with extradition treaty with the places they were targeting. What a moron, deserves everything he gets.
There may well have been a bit more in the detecting side of it but as a story the mainstream media will understand buying pizza is the way to explain it.
Nevertheless, having blagged their way through the weakest link and amassed a lot of money they do tend to thnk they're an awful lot smarted than they really are. Basically they're just hi-tech versions of the teenage robber who threw his jacket away when he escaped with his library card in the pocket or the one who threw away his cap with his name written inside - both real cases from the old days in Belfast.
"Basically they're just hi-tech versions of the teenage robber who threw his jacket away when he escaped with his library card in the pocket or the one who threw away his cap with his name written inside"
I watched a YT video where somebody stole a car and led police on a chase when he was spotted. He bolted once the car was stopped but left his ID inside. The officer got a good look at him prior so knew the ID was his. Found him a little while later. Other crims take video of their crimes and post them on social media. They post selfies (in the US) posing with a unique firearm that they get caught with later in a car while claiming it isn't theirs and they have no idea how it got there. Photos of themselves the same day showing off the stuff they stole in a smash and grab. Again, unique items that could only have come from one place. Cell phone use or just have their phone with them that puts them in the immediate area at the time of a crime. Not damning in itself, but if it's not in an area where they live, work or near to somebody they would visit, it doesn't look good in combination with other circumstantial evidence.
TL:DR, criminals are sorta stupid the vast majority of the time.
Used to watch a lot of serial killer documentaries on TV as a teenager.
A typical case might be that someone screws up during a kidnapping and the police search the suspect's home. They find a pile of ID cards in a box under the bed. When typing those names in to the police computer it turns out all of those people are missing persons, who went missing at the same time the suspect went to that city on a business trip. Prior to this they hadn't even considered that any of the missing persons cases were even connected to each other, and none of the bodies had been found.
I learned 2 things:
1. There are probably a lot of now-deceased serial killers who got away with it their entire lives. We don't know it ever happened, and never will.
2. Giving someone an excessively detailed version of this "only dumb criminals get caught" argument can result in a change in their behaviour when in my presence.
"Criminals who get caught are stupid, not quite the same thing."
Weeeeeel, yeah, but we don't know about the ones that don't get caught. They might be dead.
They are probably walking amongst us. Be afraid. Be very very afraid.
At least we have a name for one class of the most vile unprosecuted criminals, "Politicians".
Hiding from law enforcement really isn't that easy. Among other things, there are relatively few countries that don't have an extradition treaty with the US and the UK, and they can still definitely extradite you anyway without a treaty if they feel like it. You have to find one which won't extradite you, treaty or no treaty, and most of the countries willing to do so might not be where you want to live. Alternatively, you can find one willing to not be very clear on who you are so that you can be there and not be found.
For example, Russia doesn't have an extradition treaty with either country and is well-known for not extraditing criminals there, but they don't do it because the Russian Constitution says that Russian citizens can't be extradited by them, no exceptions. They might not anyway if they didn't want to, but if the people we're looking for are citizens, they definitely won't. If you're not a Russian citizen, getting into Russia is no guarantee of anything. You can be an Edward Snowden, for whom granting asylum is a way to annoy the countries Russia's annoyed with, you can make a case that you'll be useful, or you can be a person Russia doesn't want to deal with. In the latter case, you're getting deported out of Russia to make them not your problem, either to the country requesting your extradition because they're trying to be helpful or just to your country of citizenship, which in this case would be the UK.
"Some people manage to make bitcoin heists untraceable. At least make your wallets offline."
Crypto has been sold as being anonymous, but law enforcement agencies have found ways to connect people to accounts and since it's baked in, there isn't a way to update the coin to prevent them from doing it again. It can be done, but takes an effort on the part of a criminal.
I can remember reading a book by Kevin Mitnik (listened, actually) where he talks about getting a burner phone where you've absolutely kept your identity out of it. It's not a simple process and goes to illustrate the sorts of things you have to do when you need to keep something at an arm's length to not get caught. CCTV is everywhere and plenty of things get time stamped so if the coppers know that a burner phone was bought at a corner shop at a certain date/time, they can often retrieve images/video. Boom, caught. You'd have to get some stranger to buy the phone for you and get it away from any CCTV so that person isn't tracked to where they meet with you. Phones can be cheap, but how would you do something like that with crypto? You'd really have to trust some stranger a lot to give them a stack of money or withdraw a stack of money through a crypto ATM to turn the funds into cash.
This illustrates the privacy / AI / analytics issue. The reason governments are so interested in AI is to make this detection process possible for human rights issues. By that I mean is we consider it a right to criticise the government or practice free speech. At the moment it is impossible in terms of manpower and cost to go after those anonymously posting. But with AI as an agentic detective combined with DIgital ID and CBDC it becomes a simple matter to tell the AI to starve anyone critcising the government or their policies.
Yes, most are thinking that is ridiculous, but it's not. If you look at what happened during convid it tells you the mindset of many government people. Police stopping people swimming in the sea or walking alone. Walking the same way around supermarkets, wearing masks that can't stop a virus, coerced vaccination that works, doesn't work, kids don't need, now they do, stops the disease dead but then doesn't stop you getting it, stops transmission then it doesn't... The censorhip of all alternative views even from the most eminent and qualified of scientists.
And people still believe the shit they are told which guarantees dystopia will come. Maybe we're in it already!
And here's the real issue. Crypto fundamentally isn'tfundamentally" if the journal is public; with enough time, computing power and manpower, the transactions can be traced in a pattern. Join than pattern up to subpoena powers against crypto servers and ISP inquires and bam, you've got your fool.
But the crims still believe the crypto hype of allowing them anonymous crime. A journal that records everything can and will be un-anonymized if and when needed. History has now proven that.
"Like a bolt hole in a country that doesn’t have an extradition treaty with UK or US"
Well, the "know" that crypto is anonymous. That's been one of it's biggest selling points aside from the tax authorities not being able to take their share.
It's only whispered that the above really isn't true while it gets repeated over and over again.
"ost idiots these days get a tattoo to be uniquely identifiable, but this is close :)"
There are some people that get a QR code that can be scanned to take you to their website or social media. I expect that will be unreadable after some period of time and it's hauntingly similar to the Nazis tattooing serial numbers on Jewish detainees. For the police, it doesn't have to be a machine readable code since they will photograph all tattoos on somebody arrested/incarcerated and can use them in the same (or better) way than facial recognition.
One thing the Risky Business security podcast has been saying for years: amusingly, anonymous and untraceable crypto is anything but, at least compared to cash. Precisely due to its immutable blockchain history.
Not only that, but as the forensics tools improve, criminals may find themselves arrested for breakthroughs on crimes they committed years and decades ago. So, in many cases, you're never truly safe until the statute of limitations kicks in (on all the crimes you can be charged with).
Scattered Spider, btw, is more known for extremely good social engineering - a la Kevin Mitnick - than sheer tech chops.
There is no statute of limitations in the UK for most criminal offences. The main exceptions are traffic tickets and summary offences. Some offences under the Computer Misuse Act can be summary offences, but I don't think anything involving stealing tens of millions of pounds worth of BTC would be.
"There is no statute of limitations in the UK for most criminal offences. "
It's not a bad policy. After a certain period of time has gone by, it may not be possible to find witnesses, detectives and physical evidence may have been lost or degraded. For the most serious of crimes, I have to agree that a no time limit policy is a good one since things like DNA matching has improved by large measures. Those forensic techniques wind up being expensive or the labs are woefully understaffed/underfunded to be looking back through materials decades old so an aging theft of auto case is never going to get the full suite of modern investigation tools applied to it. Not unless it's connected to something more serious.
"Not only that, but as the forensics tools improve, criminals may find themselves arrested for breakthroughs on crimes they committed years and decades ago. So, in many cases, you're never truly safe until the statute of limitations kicks in (on all the crimes you can be charged with)."
That's an excellent observation. If you did a "one and done" crime and lived as a saint afterwards, the statute of limitations might be your savior. Let's be honest though, that's hardly what criminals do. Even to be excluded from prosecution for crimes where the time limit has run out, a person can become a "person if interest". The detectives see a pattern in the M.O and when that same modus operandi shows up again, they have somebody to investigate. Maybe it's not you and they know it, but somebody they know you are associated with so that person is looked into. Don't copy somebody else's methodology if you know them. This is why prisons keep track of "friend" networks.
"Perhaps the most apparently incriminating is that somebody took cryptocurrency from a wallet on a server that also held ransom funds and bought gaming gift cards tied to an account in Jubair's name, as well as food delivery gift cards, which were then used to order takeout to the apartment complex where he lived – or so investigators claim."
Interesting point this, well it's interesting for anyone who might use the Mullvad VPN and buys "time" on their VPN via Amazon.
