BREAKING AT&T Data Breach: ‘Nearly All’ Wireless Customers Exposed in Massive Hack
Connect with us

Hi, what are you looking for?



UK Man Suspected of Being ‘Scattered Spider’ Leader Arrested

A British man has been arrested in Spain for allegedly being the ringleader of the notorious Scattered Spider cybercrime group.

Hacker arrested

A 22-year-old man from the United Kingdom was recently arrested in Spain over his alleged leadership role in the notorious Scattered Spider cybercrime group.

Spanish news website Murcia Today reported on June 14 that an unnamed British man had been arrested in Palma de Mallorca as he was trying to board a flight to Italy. The arrest was the result of collaboration between Spanish police and the FBI.

The FBI announced in May that it had been seeking to charge members of the Scattered Spider cybercrime group, whose members are largely believed to be from the US and western countries, and some from eastern Europe. One alleged member of the group, a 19-year-old from Florida, was arrested in January. 

Active since early 2022, Scattered Spider is also known as Starfraud, UNC3944, Scatter Swine, and Muddled Libra. Its financially motivated operations have targeted organizations in customer relationship management (CRM), business-process outsourcing (BPO), telecoms and the technology sectors. 

The group leverages sophisticated social engineering attacks, which often involve SIM swapping. It’s well known for attacks involving the deployment of BlackCat (Alphv) ransomware, including against hospitality and entertainment giant MGM Resorts

The threat actor is also believed to be behind the 0ktapus campaign, which targeted at least 130 organizations, including Twilio and Cloudflare, as part of an SMS-based phishing campaign whose goal was the theft of Okta identity service credentials. 

The research and threat intelligence group Vx-Underground reported that the individual arrested last week in Spain is known online as ‘Tyler’ and he specializes in SIM swapping. He allegedly played a key role in the MGM hack. 

Cybersecurity blogger Brian Krebs learned from sources that the suspect is Tyler Buchanan from Scotland. Krebs said he is believed to be associated with the online moniker Tylerb, who was allegedly targeted in physical attacks by a rival SIM swapping gang. 

Advertisement. Scroll to continue reading.

Physical attacks between rival groups are not uncommon and Tylerb reportedly fled the United Kingdom after a home intrusion conducted by individuals hired by rival SIM swappers. 

Related: Massive 911 S5 Botnet Dismantled, Chinese Mastermind Arrested

Related: Cryptojacker Arrested, Charged for Defrauding Cloud Providers of $3.5 Million

Related: Two People Arrested in Australia and US for Development and Sale of Hive RAT

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.


Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.


People on the Move

ICS and OT cybersecurity solutions provider TXOne Networks appoints Stephen Driggers as new CRO

Identity orchestration provider Strata Identity appoints Aldo Pietropaolo as Field CTO

Cybersecurity provider for the aviation industry Cyviation has appointed Eliran Almog as Chief Executive Officer.

More People On The Move

Expert Insights