19-year-old charged in massive international extortion case

An image of a keyboard and coins with crypto logos. (Pexels / Jakub Zerdzicki)

A U.K. national is facing a list of charges related to major cyber attacks targeting critical U.S. infrastructure, businesses and the American court system, following a massive international investigation, the details of which were made public Thursday.

The RCMP was part of an extensive worldwide network of police services that helped the FBI zero in on a group calling itself “Scattered Spider,” U.S. officials say.

Thalha Jubair, 19, is charged with conspiracies to commit computer fraud, wire fraud and money laundering, in relation to at least 120 computer network attacks and extortion involving 47 U.S. entities, according to a news release from the U.S. Department of Justice’s (DOJ’s) Office of Public Affairs.

The scheme targeted victims throughout the country, said Alina Habba, acting U.S. attorney and special attorney for the District of New Jersey.

A news release outlining details of a complaint filed in New Jersey stated U.K.-based Jubair went by various aliases, including “EarthtoStar,” “Brad,” “Austin” and “@autistic.” U.S. officials allege he plotted with others to gain unauthorized access into the computer networks of several U.S. companies. It is alleged that Jubair and others then stole and encrypted information, and demanded ransom payments from victims in exchange for regaining control and preventing the spread of the exfiltrated data.

Jubair and his partners were allegedly involved in approximately 120 network hacks between May 2022 and September 2025, including infringing the computer networks of at least 47 victims based in the U.S. In October 2024 and January 2025, officials claim, Jubair participated in a plan to break into the networks of a U.S.-based critical infrastructure company and the U.S. courts.

Parts of the ransom payments from at least five victims were allegedly sent to wallets on a server controlled by Jubair. At least US$115 million in ransom was paid by victims, the U.S. DOJ says.

In July 2024, while law enforcement was in the process of seizing a server, Jubair is alleged to have transferred a portion of cryptocurrency worth approximately US$8.4 million at the time to another virtual wallet – funds that came from one of the victims, the complaint states.

Jubair is also accused of conspiring with others to launder the funds derived through this scheme.

Officials say that along with “Scattered Spider,” this cyber threat group was referred to as “Octo Tempest,” “UNC3944,” and/or “0ktapus.”

If convicted, Jubair faces a maximum penalty of 95 years in prison, U.S. officials say. None of the allegations has been proven in court.

In addition to the RCMP, police in the Netherlands, Romania and Australia also helped with the case.