By rifanmuazin 
In a significant victory for international law enforcement, two key members of the prolific cybercrime collective known as "Scattered Spider" pleaded guilty this week in a London court. Their admissions of guilt, delivered on the first day of what was slated to be a high-stakes, six-week trial, mark a pivotal moment in the global effort to dismantle one of the most sophisticated and destructive hacking rings of the digital age.
Thalha Jubair, 20, of East London, and 18-year-old Owen Flowers of Walsall, stood before the court to answer for their roles in a series of catastrophic cyberattacks. Their most notable crime—a massive August 2024 assault that crippled the public transport network of Greater London—brought the city to a standstill and highlighted the fragility of critical infrastructure in the face of modern cyber-extortion.
The Charges and the Confessions
The scope of the duo’s criminal activity, as outlined by prosecutors, is staggering. Both Jubair and Flowers pleaded guilty to conspiring to commit unauthorized acts against the computer systems of Transport for London (TfL), an act that carried the grave additional charge of risking "serious damage to human welfare."
For Flowers, the admissions extended beyond British borders. He confessed to participating in a wider conspiracy targeting the U.S.-based healthcare giants SSM Health Care Corporation and Sutter Health in September 2024. The inclusion of healthcare providers in their target list underscores the brazen nature of Scattered Spider, a group that has historically shown little hesitation in compromising sensitive medical and public safety data to extort massive payouts.
A Chronology of Digital Chaos
To understand the severity of the charges against Jubair and Flowers, one must look at the timeline of the Scattered Spider "reign of terror." The group, often comprised of young, highly skilled hackers operating across borders, evolved from simple phishing enthusiasts into a global threat actor capable of holding multi-billion-dollar corporations hostage.
2022: The SMS Phishing Spree
The foundation of their operation was built in the summer of 2022. Prosecutors allege that Jubair was instrumental in a mass SMS phishing campaign that targeted employees at hundreds of organizations. This campaign was not merely a nuisance; it served as a gateway to major data breaches at high-profile firms including LastPass, DoorDash, Mailchimp, Plex, and Signal. By stealing single sign-on credentials, the group bypassed standard corporate defenses with ease.
2023: The Casino Siege
By September 2023, the group had pivoted to high-impact ransomware. Investigators identified Owen Flowers as the voice behind the curtain during the infamous attacks on MGM Resorts and Caesars Entertainment. Sources familiar with the investigation confirmed that Flowers acted as the group’s media liaison, providing anonymous interviews to news outlets to taunt law enforcement and amplify the pressure on the targeted casinos.
2024-2025: Escalation and Infiltration
The group’s ambitions grew in 2024 and 2025. They targeted the Co-op Group, Marks & Spencer, and Harrods in the UK, while simultaneously expanding their U.S. footprint. According to a New Jersey indictment unsealed in September 2025, Jubair and his associates were responsible for 120 separate network intrusions across 47 U.S. entities, resulting in a staggering $115 million in ransom payments.
The Mechanics of Extortion: Star Chat and SIM-Swapping
One of the most chilling aspects of the evidence presented against Jubair is his role in operating "Star Chat." This Telegram-based command center functioned as a clearinghouse for criminal services, most notably SIM-swapping.
Through Star Chat, Jubair and his co-conspirators leveraged voice and SMS-based phishing to compromise employees at major telecommunications providers in both the U.S. and the UK. Once they gained access to internal employee tools, they could redirect a victim’s phone number to a device under their control. This allowed them to intercept two-factor authentication (2FA) codes, effectively locking the victim out of their own bank accounts, corporate portals, and encrypted communication platforms.
Evidence seized by authorities even included a receipt from "Rocket Ace"—one of Jubair’s hacker aliases—demonstrating a successful SIM-swap against a T-Mobile customer.
A History of Early Radicalization
The investigation also revealed that these operations were not the work of seasoned intelligence operatives, but rather teenagers who honed their craft in the dark corners of the internet. Before becoming a linchpin of Scattered Spider, Jubair was known in hacking circles by the alias "Everlynn."
As a 15-year-old, "Everlynn" was already peddling fraudulent "emergency data requests" (EDRs). By compromising police and government email accounts, he and his peers would send urgent, forged requests to tech companies, claiming that the data was required to save lives. This tactic bypassed the traditional court-ordered warrant process, allowing them to acquire private user information—such as IP addresses and account details—under the guise of law enforcement necessity.
Official Responses and Global Cooperation
The downfall of Jubair and Flowers is the result of years of tireless cooperation between the UK’s National Crime Agency (NCA), the FBI, and the U.S. Department of Justice.
"The plea is a testament to the resilience of our international partnerships," noted one official close to the case. However, the work is far from finished. The U.S. Department of Justice remains in pursuit of other key Scattered Spider figures. Indictments remain active for individuals such as Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, and Joel Martin Evans.
These recent developments follow a series of successful prosecutions:
- Tyler "Tylerb" Buchanan: In April 2026, the 24-year-old British national pleaded guilty to wire fraud and identity theft, admitting to his role in the 2022 SMS phishing spree that netted the group at least $8 million in cryptocurrency.
- Noah Michael Urban: In August 2025, the 20-year-old Florida native was sentenced to a decade in federal prison and ordered to pay $13 million in restitution.
Implications for Corporate Cybersecurity
The Scattered Spider case serves as a grim case study for the modern enterprise. The group’s success was not due to sophisticated "zero-day" exploits or highly complex code; it was due to the exploitation of the human element. By targeting the employees—the "weakest link"—and utilizing the very tools intended to protect them (like 2FA and SIM-based authentication), the hackers proved that technical defenses are only as strong as the policies governing human access.
The implications for companies are clear:
- Move Beyond SMS-Based 2FA: The ease with which these hackers performed SIM-swaps mandates a shift toward hardware security keys or app-based authenticator tokens that cannot be intercepted via telecommunications infrastructure.
- Strict EDR Protocols: The "Everlynn" case highlights a dangerous vulnerability in how tech companies process urgent data requests. Stricter verification of the originating email addresses and a formal, non-negotiable verification process for law enforcement requests are now industry standard.
- Internal Tool Security: The access these hackers gained to internal carrier systems proves that internal administrative tools are prime targets. Zero-trust architecture is no longer an optional security layer; it is an existential necessity.
Conclusion: A Turning Point?
As Jubair and Flowers await their sentencing on July 15, 2026, the tech industry and law enforcement look on with a mixture of relief and caution. While the dismantling of the Scattered Spider leadership is a major success, the decentralized nature of modern cybercrime groups means that the tools and tactics pioneered by this group are likely being adopted by others.
The guilty pleas represent a closure for the victims of the TfL attack and the dozens of U.S. companies affected by the group’s relentless phishing campaigns. However, the case also serves as a sobering reminder of how much damage can be inflicted by a small, determined group of individuals wielding nothing more than a smartphone and a sophisticated understanding of human psychology. For now, the "Star Chat" network is quiet, but the global cybersecurity landscape remains as volatile as ever.
Asro 
Jia Lissa 