Alleged longstanding member of Scattered Spider extradited to US
Alleged Scattered Spider member Peter Stokes extradited to US on cybercrime charges.
Summary
Peter Stokes, a 19-year-old alleged member of the Scattered Spider extortion crew, has been extradited to the United States to face cybercrime charges. Stokes, who allegedly joined the group in 2022, is accused of participating in data theft and extortion schemes that have impacted over 100 businesses globally, extorting more than $100 million. He was arrested in Finland and is now in federal custody in Chicago.
Full text
A 19-year-old alleged member of the Scattered Spider extortion crew was extradited to the United States last week and remains in federal custody awaiting several cybercrime charges, the Justice Department said Wednesday. Peter Stokes, a dual citizen of the United States and Estonia, was allegedly involved in Scattered Spider since it formed in 2022 and boasted on social media about the luxurious globetrotting life he enjoyed while he was still a child. The cybercrime ring of young, native English-speaking people has infiltrated more than 100 businesses since 2022, and extorted more than $100 million from its victims around the world, officials said. “Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,” Brett Leatherman, assistant director of the FBI’s cyber division, said in a statement. “Through strong domestic and international partnerships, the FBI will continue to identify, disrupt, and hold cybercriminals accountable, no matter where they are located.” Stokes, also known as “Bouquet” and “Jordan,” is accused of participating in multiple data theft and extortion attempts, but the FBI only provided specific details about some more recent attacks on a luxury jewelry retailer in May 2025 and a U.S.-based insurance company in June 2025. Cybercrime researchers have been tracking Stokes’ online activity since 2022. Microsoft determined his true identity and implicated Stokes as a member of Scattered Spider in a criminal referral in October 2024, according to court records. He was still a child at that time, and authorities typically don’t arrest known cybercriminals until they reach adulthood. Stokes lived in Estonia and the United Arab Emirates while he allegedly committed some of his crimes. Police arrested Stokes in Finland as he attempted to board an April 10 flight to Japan, possessing two hard drives containing allegedly incriminating evidence. He made an initial court appearance in Chicago Tuesday and was ordered to remain in jail. Stokes exhibited an opulent life before his capture, according to his social media activity and State Department travel records. This included trips and multiple stays in luxury hotels in Paris, Italy, Spain, Germany, New York, Florida, New Mexico, Thailand and Dubai between 2024 and 2025, according to a criminal complaint filed against him in the U.S. District Court for the Northern District of Illinois. He also posted images of watches, substantial cash and an apparently diamond-encrusted chain depicting the words “Hack the Planet.” Images from Peter Stokes’ Snapchat account in February 2025 and December 2024. Credit: Justice Department Officials also noted that Stokes’ family appeared to be well off, as his father was a previous executive in two major European companies. Stokes was charged with conspiracy, cyber intrusion and fraud offenses. “The malicious attacks from Scattered Spider caused widespread disruption to businesses and organizations throughout the United States,” Andrew Boutros, U.S. attorney for the Northern District of Illinois, said in a statement. “These charges underscore our unwavering commitment to keeping pace with technologically savvy criminal actors and holding accountable those who seek to profit from cyber intrusions, including those located in foreign jurisdictions who do harm to American businesses and victims.” Share Facebook LinkedIn Twitter Copy Link
Indicators of Compromise
- mitre_attack — T1078
- mitre_attack — T1590
- mitre_attack — T1589
- mitre_attack — T1490
- mitre_attack — T1560
- mitre_attack — T1041