First Scattered Spider Member Sentenced: Noah Urban Gets 10 Years for $13 Million Cryptocurrency Theft Scheme
20-year-old Palm Coast man becomes first member of notorious cybercrime gang to face justice in federal court
In a landmark cybercrime prosecution, Noah Urban, a 20-year-old Palm Coast man linked to a massive cybercriminal gang was sentenced to 10 years in prison on Wednesday morning after pleading guilty to federal charges, including conspiracy and wire fraud. The sentencing marks the first time a member of the notorious "Scattered Spider" cybercrime organization has faced justice in federal court.
Breached Company
The Sentence and Restitution
Despite federal prosecutors requesting eight years and the defense requesting five years for Noah Urban, a federal judge decided to sentence Urban to 120 months in federal prison, with three years of supervised release. He also has to pay $13 million in restitution to victims.
US District Judge Harvey Schlesinger delivered the sentence to Noah Urban in federal court in Jacksonville, Florida. Urban was the first member of Scattered Spider to be sentenced. The judge exceeded both prosecution and defense recommendations, highlighting the severity of Urban's crimes.
Breached Company
The Crimes: SIM Swapping and Cryptocurrency Theft
In the Florida case, Urban was accused of stealing at least $800,000 in cryptocurrency from five different victims between August 2022 and March 2023. Prosecutors said Urban and others would steal victims' personal information and arrange for the victims' cell phone numbers to be swapped to phones that Urban and the other conspirators controlled.
The prosecution revealed that Urban and others would steal victims' personal information and arrange for the victims' cell phone numbers to be swapped to phones that Urban and the other conspirators controlled. They would then use that to get control of the victims' cryptocurrency accounts by resetting passwords and confirming via text message passwords. The tactic is known as "SIM swapping."
Breached Company
Scale of the Operation
The scope of Urban's criminal activity was extensive. The agreement listed amounts, victim by victim, for both the Florida and California cases. The amounts totaled more than $13 million across 59 individuals. During a May 2023 interview with investigators, Urban estimated he had personally made "several million dollars" between January 2021 and March 2023 through cryptocurrency theft, and that he had been involved with the theft of several million more overall.
Criminal Aliases and Methods
Urban, who according to the indictment was also known by aliases including "King Bob" (a reference to the "Minions" movie) and "Gustavo Fring" (a reference to a character from "Breaking Bad"), is believed to be a member of a group called "Scattered Spider." He was also known by additional aliases including "Sosa," "Elijah," and "King Bob".
Breached Company
Asset Forfeiture
As part of his plea agreement, Urban must forfeit significant assets. Urban will forfeit assets of Dai, Ethereum, Monero, Bitcoin, and Ripple cryptocurrencies, all held in various cryptocurrency wallets. While the values of cryptocurrencies can vary, the Dai is currently worth approximately $1.3 million, and the largest portion of the Ethereum is currently worth approximately $1.3 million. Urban will also forfeit $27,702 in currency seized from a Palm Coast home, plus miscellaneous jewelry and six watches.
About Scattered Spider
According to federal cybersecurity officials, the group targets large companies and their contracted IT help desks. Authorities warn that Scattered Spider members have: Posed as company IT and/or helpdesk staff using phone calls or SMS text messages to obtain login credentials from employees · Posed as company IT and/or helpdesk staff to direct employees to run commercial remote access tools, giving them access · Posed as IT staff to convince employees to share one-time passwords used for multi-factor authentication, a common security measure · Monetized access to victim networks in numerous ways, including extortion enabled by ransomware and data theft.
Scattered Spider, also referred to as UNC3944, is a hacking group mostly made up of teens and young adults believed to live in the United States and the United Kingdom. The group is believed to be affiliated with cybercriminal network named "The Com", known for its crimes against minors.
High-Profile Attacks
The group gained international notoriety for their involvement in major casino attacks. The group gained notoriety for their involvement in the hacking and extortion of Caesars Entertainment and MGM Resorts International, two of the largest casino and gambling companies in the United States. Caesars Entertainment paid a ransom of $15 million to Scattered Spider, half their original demand of $30 million, while MGM refused to pay and suffered an estimated $100 million in losses.
The attack on MGM was particularly sophisticated. Scattered Spider used LinkedIn to identify a current MGM Resorts employee, assumed their identity, and called the MGM IT help desk requesting assistance logging into their accounts. The phone call lasted ten minutes, and the attackers were able to gain administrator privileges to MGM's Okta and Azure tenant environments.
Other Notable Targets
Scattered Spider has also targeted Visa, Marks & Spencer, PNC Financial Services Group Inc., Transamerica, New York Life Insurance Co., Synchrony Financial, Truist Bank, and Twilio. The group has also been connected with the hacks against Snowflake cloud storage customers in the US and connected with the hacks against Qantas, the flag carrier of Australia.
Law Enforcement Response
Urban's case is part of a broader law enforcement crackdown on Scattered Spider. Five alleged members of the infamous Scattered Spider cybercrime crew have been indicted in the U.S. for targeting employees of companies across the country using social engineering techniques to harvest credentials and using them to gain unauthorized access to sensitive data and break into crypto accounts to steal digital assets worth millions of dollars.
The other co-defendants include Ahmed Hossam Eldin Elbadawy, 23, aka AD, of College Station, Texas and Tyler Robert Buchanan, 22, aka tylerb, of the U.K. among others.
International Arrests
Law enforcement efforts have extended internationally. In July 2024, the West Midlands Police with the help of the FBI arrested a 17-year old juvenile in connection with the MGM cyberattacks. The suspect, who lives in Walsall and whose name was not published, was released on bail while law enforcement examined his devices.
Federal Charges and Plea
In April, Urban pleaded guilty to charges in two separate federal cases: charges in Florida that were unsealed in January 2024, and charges in southern California that were announced in November of last year. In the Florida case, Urban pleaded guilty to conspiracy to commit wire fraud, and one count each of wire fraud and aggravated identity theft. In the California case, he pleaded guilty to one count of conspiracy to commit wire fraud.
Impact Beyond Financial Crimes
Urban's criminal activities extended beyond financial theft. Urban had gained notoriety beyond financial crimes for leaking unreleased songs from artists including Ariana Grande, Lil Uzi Vert, and Playboi Carti after breaking into music industry executives' accounts through SIM swap attacks.
Complete Information on All Five Co-Defendants
1. Ahmed Hossam Eldin Elbadawy, 23
- Location: College Station, Texas
- Alias: "AD"
- Status: Whereabouts unknown
- Role: FBI investigators identified Elbadawy after he used a portion of cryptocurrency funds stolen from a victim company to pay for an account used to register phishing domains. The indictment alleges Elbadawy controlled a number of cryptocurrency accounts used to receive stolen funds
2. Tyler Robert Buchanan, 22
- Location: 22-year-old from Dundee, Scotland
- Alias: "tylerb"
- Status: Extradited from Spain to the United States
- Arrest Details: Arrested at an airport in Palma — a resort city on the Spanish island of Mallorca — as he attempted to board a charter flight to Naples
- Leadership Role: Spanish authorities say Buchanan is the suspected head of Scattered Spider
- Criminal History: Buchanan fled the United Kingdom in February 2023, after a rival cybercrime gang hired thugs to invade his home, assault his mother, and threaten to burn him with a blowtorch unless he gave up the keys to his cryptocurrency wallet
- Cryptocurrency: The Spanish police told local media that Buchanan possessed Bitcoins worth $27 million
- Evidence: When the Scottish police raided Buchanan's home in 2023 they found "approximately twenty devices" and one of Buchanan's devices was found to contain a phishing kit that was "designed specifically to transmit the captured information to a Telegram channel"
3. Evans Onyeaka Osiebo, 20
- Location: Dallas, Texas
- Status: Whereabouts unknown
- Role: The indictment alleges Elbadawy controlled a number of cryptocurrency accounts used to receive stolen funds, along with another Texas man — Evans Onyeaka Osiebo
4. Joel Martin Evans, 25
- Location: Jacksonville, North Carolina
- Alias: "joeleoli"
- Status: Evans was arrested Tuesday by the FBI in North Carolina and is expected to make his initial court appearance Wednesday
- Background: That Joeleoli moniker registered on the cybercrime forum OGusers in 2018 with the email address [email protected]. Prosecutors say Joeleoli's real name is Joel Martin Evans
- Connection to Gaming: Comments suggest he was involved in the "toxic Minecraft PVP community" and "HCF" sub-community, and was known for "programming services" with reports of scams dating back to 2018
5. Noah Michael Urban, 20 (Already sentenced)
- Location: Palm Coast, Florida
- Aliases: "Sosa," "Elijah," and "King Bob"
- Status: Sentenced to 10 years in prison and must pay $13 million in restitution
Charges and Potential Sentences
All defendants were charged with one count of conspiracy to commit wire fraud, one count of conspiracy, and one count of aggravated identity theft. If convicted, each defendant faces up to 20 years in federal prison for conspiracy to commit wire fraud, up to five years in federal prison for conspiracy, and a mandatory two-year consecutive prison sentence for aggravated identity theft. Buchanan would face an additional maximum sentence of 20 years in prison for the wire fraud count
Current Status Summary
- Noah Urban: Sentenced to 10 years (first to be sentenced)
- Tyler Buchanan: Extradited from Spain to the United States
- Joel Martin Evans: Arrested Tuesday by the FBI in North Carolina
- Ahmed Hossam Eldin Elbadawy: Whereabouts unknown
- Evans Onyeaka Osiebo: Whereabouts unknown
This represents a major law enforcement operation targeting the core leadership of Scattered Spider, with Tyler Buchanan being identified as the suspected leader of the group and Noah Urban being the first to face sentencing.
Conclusion
The sentencing of Noah Urban represents a significant milestone in the fight against sophisticated cybercrime organizations like Scattered Spider. His 10-year sentence and $13 million restitution order send a strong message about the consequences of participating in large-scale cryptocurrency theft and social engineering schemes.
As the first Scattered Spider member to be sentenced, Urban's case provides important precedent for the prosecution of other members of this and similar cybercrime organizations. The extensive law enforcement investigation that led to his capture demonstrates the increasing sophistication of authorities in tracking down cybercriminals who operate across international boundaries.
The case also highlights the ongoing threat posed by social engineering attacks and the vulnerability of both individuals and major corporations to these sophisticated schemes. As Urban begins his decade-long prison sentence, law enforcement continues to pursue other members of Scattered Spider and similar organizations that pose significant threats to cybersecurity worldwide.
