Teen Extradited from Finland Faces Federal Charges Over Scattered Spider Hacking Syndicate
Peter Stokes, a 19-year-old extradited from Finland, has been charged by the US DOJ for alleged involvement in Scattered Spider, a hacking group linked to over $100 million in ransom payments and more than 100 corporate network intrusions.
A 19-year-old dual US-Estonian citizen named Peter Stokes has been charged by the US Department of Justice with conspiracy, computer intrusion, and fraud for his alleged involvement in the Scattered Spider hacking group. Finnish authorities arrested Stokes in April and extradited him to the United States last week following an FBI investigation. He appeared in federal court in Chicago on Tuesday, where a judge ordered him held in custody.
FBI Chicago Special Agent-in-Charge Douglas S. DePodesta announced the extradition alongside federal prosecutors. The Justice Department's Office of International Affairs and Finland's National Bureau of Investigation jointly coordinated the handover.
Scattered Spider, also identified by aliases including 0ktapus, Octo Tempest, and UNC3944, is accused of carrying out more than 100 network intrusions, according to the DOJ complaint. Federal investigators estimate the group collected in excess of $100 million in ransom payments over the course of its operations.
The syndicate's methods center on social engineering rather than advanced exploits. Members deceive corporate employees into handing over account credentials, then encrypt or exfiltrate company data before demanding cryptocurrency payments. Victims either pay to recover their data or to prevent its public release.
The complaint specifically alleges that Stokes and co-conspirators breached a luxury jewelry retailer in May 2025. The intruders copied sensitive company data and demanded approximately $8 million in cryptocurrency. The retailer's security team successfully removed the attackers, and no ransom was paid — however, the company still sustained at least $2 million in losses through business disruption, forensic investigation, and threat mitigation efforts.
«Scattered Spider has repeatedly targeted US companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,» said FBI Cyber Division Assistant Director Brett Leatherman.
The case is being prosecuted under Operation Riptide, the FBI's ongoing campaign targeting cybercrime and fraud networks. The broader context underscores escalating digital crime: Americans reported more than $20 billion in cybercrime losses last year, a 26% increase year-over-year. Since 2020, the DOJ's computer crime section has secured convictions of over 180 cybercriminals, with courts ordering the return of more than $350 million in victim funds.
Separately, blockchain analytics firm Chainalysis reported that on-chain ransomware payments declined for a second consecutive year in 2025, suggesting that groups like Scattered Spider may be compensating by increasing the frequency of attacks rather than the size of individual demands.
Enforcement action across the broader crypto crime landscape has intensified in parallel. This week, Tether froze sanctioned TRON wallets linked to ISIS-K. In June, a federal judge sentenced a crypto influencer impersonator to 15 months in prison.
Stokes has not been convicted, and the charges against him remain allegations. He awaits trial in Chicago. Prosecutors have indicated the arrest could serve as a stepping stone toward a wider dismantling of the Scattered Spider syndicate.
