An alleged member of the Scattered Spider cybercrime group has been extradited from Finland to the United States to face federal charges related to conspiracy, cyber intrusion, and fraud. U.S. authorities said the case marks another step in their ongoing efforts to prosecute individuals accused of participating in high-profile cybercrime operations linked to the notorious hacking group.
Peter Stokes, 19, a dual U.S. and Estonian citizen, made his initial appearance in federal court in Chicago after being extradited from Finland.
According to the U.S. Department of Justice, Stokes was arrested by Finnish authorities in April following an Interpol Red Notice and was transferred to the United States last week. A criminal complaint filed in the Northern District of Illinois accuses him of participating in cyberattacks carried out as part of the Scattered Spider group.
Scattered Spider Linked to More Than 100 Network Intrusions
According to the complaint, Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, has been associated with more than 100 network intrusions. Authorities allege the group’s activities have resulted in over $100 million in ransom payments and millions of dollars in additional damages suffered by victims.
Investigators said the group targeted companies across the United States by obtaining access to employee accounts through fraudulent methods.
Once inside corporate networks, the attackers allegedly encrypted data or exfiltrated sensitive information to remote servers before demanding cryptocurrency payments to restore access or prevent the public release of stolen data.
Complaint Details Alleged Luxury Retailer Cyberattack
The criminal complaint describes an alleged cyber intrusion that occurred in May 2025 involving a luxury jewelry retailer.
Federal prosecutors allege that Stokes and other co-conspirators breached the retailer’s computer systems, exfiltrated company data, and demanded approximately $8 million in cryptocurrency as ransom. According to court documents, the retailer’s security team successfully removed the threat actors from its network before any ransom payment was made.
Although the company did not pay the ransom, authorities said it still incurred losses of at least $2 million due to business disruption, investigation costs, and mitigation efforts following the incident.
Operation Riptide Targets Cybercrime Networks
The extradition and criminal charges were announced by the Department of Justice, the U.S. Attorney’s Office for the Northern District of Illinois, and the FBI. The investigation also involved the FBI’s Copenhagen Law Enforcement Attaché Office, the FBI Las Vegas Field Office, the Justice Department’s Office of International Affairs, and Finland’s National Bureau of Investigation.
Officials said the case forms part of Operation Riptide, an ongoing FBI campaign focused on disrupting cybercriminal actors, infrastructure, financial networks, and fraud schemes targeting Americans.
According to the FBI, Americans reported more than $20 billion in cybercrime losses last year, representing a 26% increase compared with the previous year.
Authorities Cite International Cooperation
Assistant Attorney General A. Tysen Duva said the charges stem from years of investigative work by the Justice Department, the U.S. Attorney’s Office, and the FBI, adding that authorities would continue working together to pursue cybercriminals operating across international borders.
U.S. Attorney Andrew S. Boutros said the alleged attacks caused significant disruption to businesses across the United States and emphasized the government’s commitment to prosecuting individuals involved in cyber intrusions.
FBI Special Agent-in-Charge Douglas S. DePodesta also highlighted the role of international law enforcement partnerships in identifying alleged members of the hacking group and pursuing cross-border cybercrime investigations.
Recent Guidance on Scattered Spider Threat
The arrest follows recent law enforcement efforts targeting the Scattered Spider threat group. In July 2025, the FBI and CISA released updated guidance describing the group’s latest attack techniques, including the use of DragonForce ransomware to encrypt VMware ESXi servers.
The advisory urged organizations to maintain isolated offline backups, implement phishing-resistant multifactor authentication (MFA), and apply application controls to manage software execution.
Separately, in November 2025, two alleged Scattered Spider members appeared before Southwark Crown Court in the United Kingdom and pleaded not guilty to charges related to the August 2024 cyberattack on Transport for London (TfL).
The Department of Justice emphasized that the complaint against Stokes contains allegations only. As with all criminal cases, he is presumed innocent unless and until proven guilty in court.
