UK cops say arrest of two young hackers disrupted the operations of an infamous hacking group

U.K constabulary said connected Thursday that the jailing of 2 teenage hackers has “severely” hampered the activities of the infamous cybercrime radical known arsenic Scattered Spider.

Owen Flowers, 18, and Thalha Jubair, 20, pleaded blameworthy earlier this twelvemonth to hacking Transport of London (TfL), the authorities assemblage overseeing the U.K. capital’s nationalist transit strategy successful 2024. The 2 were sentenced to 5 years and six months successful situation connected Thursday. 

The jailing of Flowers and Jubair is simply a reminder that, sometimes, the astir unsafe and effectual hackers don’t enactment for blase authorities agencies with millions of dollars of budget. More often, they are alternatively precise young and astute hackers motivated by wealth and infamy among their peers.

Groups specified arsenic Scattered Spider, arsenic good arsenic ShinyHunters, different cybercriminal collective, often people and exploit employees and individuals alternatively than machine systems, a strategy that’s some effectual and hard to counter.

While hacking groups’ members thin to travel and go, the groups themselves tin rebrand. But British authorities are convinced the jailing of Flowers and Jubair represents a important stroke to Scattered Spider, an amorphous radical that’s been linked to dozens of high-profile attacks, specified arsenic those against casino elephantine MGM, airline WestJet, and cybersecurity steadfast Okta. These attacks successful crook gave the hackers entree to respective of these companies customers. 

“Scattered Spider has been the astir important cybercrime menace to the U.K. successful caller years. Through this investigation, we person severely disrupted that menace and brought cardinal offenders to justice,” said Paul Foster, the caput of the U.K. National Crime Agency’s National Cyber Crime Unit. 

The 2 hackers were down the cyberattack against TfL successful summertime 2024, which took the system’s infrastructure offline, including the ticketing system, and the online real-time bid accomplishment accusation system. The disruptions lasted for weeks.

Flowers and Jubair were arrested a twelvemonth later. At the time, the FBI accused Jubair of being progressive successful attacks connected much than 120 companies utilizing social engineering tactics. 

Authorities said the onslaught against TfL resulted successful losses of astir £29 cardinal (around $47 million). The 2 hackers had specified heavy entree to TfL systems that they “could person unopen retired and unopen down TfL completely,” and held “the keys to the kingdom” to the company’s systems, according to the Guardian.