A 22-year-old man from the United Kingdom was recently arrested in Spain over his alleged leadership role in the notorious Scattered Spider cybercrime group.
Spanish news website Murcia Today reported on June 14 that an unnamed British man had been arrested in Palma de Mallorca as he was trying to board a flight to Italy. The arrest was the result of collaboration between Spanish police and the FBI.
The FBI announced in May that it had been seeking to charge members of the Scattered Spider cybercrime group, whose members are largely believed to be from the US and western countries, and some from eastern Europe. One alleged member of the group, a 19-year-old from Florida, was arrested in January.
Active since early 2022, Scattered Spider is also known as Starfraud, UNC3944, Scatter Swine, and Muddled Libra. Its financially motivated operations have targeted organizations in customer relationship management (CRM), business-process outsourcing (BPO), telecoms and the technology sectors.
The group leverages sophisticated social engineering attacks, which often involve SIM swapping. It’s well known for attacks involving the deployment of BlackCat (Alphv) ransomware, including against hospitality and entertainment giant MGM Resorts.
The threat actor is also believed to be behind the 0ktapus campaign, which targeted at least 130 organizations, including Twilio and Cloudflare, as part of an SMS-based phishing campaign whose goal was the theft of Okta identity service credentials.
The research and threat intelligence group Vx-Underground reported that the individual arrested last week in Spain is known online as ‘Tyler’ and he specializes in SIM swapping. He allegedly played a key role in the MGM hack.
Cybersecurity blogger Brian Krebs learned from sources that the suspect is Tyler Buchanan from Scotland. Krebs said he is believed to be associated with the online moniker Tylerb, who was allegedly targeted in physical attacks by a rival SIM swapping gang.
Physical attacks between rival groups are not uncommon and Tylerb reportedly fled the United Kingdom after a home intrusion conducted by individuals hired by rival SIM swappers.
Related: Massive 911 S5 Botnet Dismantled, Chinese Mastermind Arrested
Related: Cryptojacker Arrested, Charged for Defrauding Cloud Providers of $3.5 Million
Related: Two People Arrested in Australia and US for Development and Sale of Hive RAT
