UK and US authorities bring charges against two alleged dispersed spider hackers
In a significant development in the fight against cybercrime, US and UK authorities have charged two individuals, Thalha Jubair and Owen Flowers, for their alleged involvement in the notorious Scattered Spider cybercrime group.
The investigation into Jubair and Flowers was a collaborative effort between law enforcement agencies in the UK, the US, the Netherlands, Romania, Canada, and Australia. The pair are linked to attacks on high-profile targets such as Marks & Spencer, the Co-op, Harrods, US courts, a US critical infrastructure firm, and the UK's Transport for London (TfL).
Thalha Jubair, also known by aliases such as "EarthtoStar," "Brad," "Austin," and "@autistic," was arrested at his home address in East London on September 16, 2025. Jubair is accused of participation in at least 120 computer network intrusions and extortion involving 47 US entities, with victims paying at least $115m in ransom payments.
The District of New Jersey unsealed charges against Jubair on September 18, 2025, accusing him of conspiracies to commit computer fraud, wire fraud, and money laundering. Portions of the ransom payments from at least five victims were sent to wallets on a server controlled by Jubair.
Owen Flowers was also charged on September 18, 2025, with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health's networks, both based in the US. Flowers was initially arrested on suspicion of involvement in the TfL hack on September 6, 2024, while aged 17.
The arrests of four other suspected members of Scattered Spider by UK authorities occurred in July 2025. Three of these arrested individuals were teenagers at the time. The two teenagers have also been charged by UK authorities with offenses connected to the August 2024 cyber-attack on Transport for London (TfL).
Deputy Director Paul Foster of the NCA's National Cyber Crime Unit described the charges against Jubair and Flowers as a "key step" in a "lengthy and complex investigation." Jake Moore, global cybersecurity advisor at ESET and former UK police officer, highlighted the growing success of law enforcement in identifying and collecting evidence to prosecute cybercriminal actors.
However, collecting enough solid evidence to produce in court and prosecute is the most difficult aspect in any cybercrime investigation, according to Moore. The NCA has warned of an increase in the threat from cybercriminals based in the UK and other English-speaking countries, with Scattered Spider being a clear example.
Earlier in September, it was reported that Scattered Spider, along with 14 other ransomware groups, had announced their "retirement." However, these announcements have been met with skepticism by security experts.
The investigation into Jubair and Flowers and the dismantling of the Scattered Spider group mark a significant victory in the global fight against cybercrime. The collaborative effort between international law enforcement agencies demonstrates the importance of cooperation in tackling this transnational threat.
