DoJ: Alleged Scattered Spider Member Extradited to US

An alleged member of the notorious Scattered Spider group was arrested earlier this year in Finland and extradited last week to the U.S., where he will face federal criminal conspiracy charges.

19-year-old Peter Stokes, who is a dual citizen of the U.S. and Estonia, is being charged with conspiracy, computer intrusion, and fraud; he appeared on Tuesday in federal court in Chicago and will remain in law enforcement custody. 

Stokes is one of several to be arrested for their alleged participation in Scattered Spider, a collective of cybercriminals known for high-profile extortion attacks of well-known names like MGM Resorts International, as well as Visa, Marks and Spencer, and more. Other alleged members arrested between 2024 and 2026 include Noah Michael Urban, Tyler Buchanan, Thalha Jubair, and Owen Flowers.

“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division in a Wednesday statement. 

According to the DoJ’s complaint, Stokes (using the online monikers “Bouquet” and “Jordan”) reportedly breached an unnamed luxury jewelry retailer, exfiltrated its data, and made a ransom demand of $8 million in cryptocurrency during May 2025. The complaint also alleges that he created an account with a secure tunneling data transfer tool via a VPN proxy service.  There were a few other interesting aspects of the complaint, including:

• Criminal referrals made by Microsoft in October 2024 implicated Stokes. The DoJ said multiple, similar referrals from Microsoft during this investigation as well as others have been corroborated further by later legal process issued via the government 
• Stokes flaunted his wealth on Snapchat, including pictures showing him traveling across the world and staying in luxury hotels between 2024 and 2025 (when he was 17-18 years old); other pictures showed watches, substantial amounts of cash, and diamond encrusted chains that said HACK THE PLANET
• Stokes also sent various Snapchat messages indicating his involvement with Scattered Spider activities; in one image, he depicted monikers for Scattered Spider members as mafia characters from The Sopranos
• On November 2024, another suspected Scattered Spider member (domr212) sent Stokes an image of a computer showing failed login attempts with the caption “Fuck off FBI”

The DoJ said Stokes’ arrest is part of Operation Riptide, an ongoing FBI campaign targeting the criminal actors, infrastructure, and networks behind cybercrime. The operation has also led to the takedown of a VPN service widely used by cybercriminals called First VPN.