fbi investigation

Microsoft device telemetry key to unmasking alleged Scattered Spider hacker

a month ago

Peter Stokes, a 19-year-old American-Estonian, was extradited from Finland to the U.S. on hacking charges linked to Scattered Spider.
An FBI affidavit ties him to an $8 million ransom demand via a Microsoft Global Device Identifier (GDID) that was unmasked despite VPN use.
Microsoft's cyber security researchers provided the GDID, which is used for diagnostics and abuse detection, after a court order based on ngrok service records.
The GDID's IP history matched logins to Stokes's Snapchat, Apple, and Facebook accounts in locations like Tallinn, New York, and Thailand.