America’s Justice Department and FBI teamed with Finland’s National Bureau of Investigation to arrest a teenager they say belongs to one of the world’s biggest cybercrime gangs.
According to Tom’s Hardware the Scattered Spider syndicate has extorted more than $100 million in ransom payments, according to Department of Justice figures.
Peter Stokes, 19, is a dual US-Estonian citizen who was trying to board a flight from Helsinki to Japan when the plod caught up with him.
The main criminal complaint against Stokes stems from a May 2025 attack on a luxury jewellery dealer in the US. The attackers allegedly called the company’s IT helpdesk using Google Voice and impersonated employees.
They convinced the helpdesk to reset the credentials, which allowed them to break into three accounts, two of which had admin privileges. From there, the group, allegedly including Stokes, stole important data and held the jeweller to ransom, demanding an $8 million crypto payment.
The company eventually regained access to its infrastructure and avoided paying the ransom. Still, the disruption allegedly caused $2 million in losses, which was enough to set prosecutors on the trail.
Microsoft played a key role by providing Global Device Identifier data to the FBI to help catch the alleged crook.GDID is a unique identifier assigned to every Windows install and tracks device-specific telemetry.
It is the reason changing a major component in a PC can sometimes cause Windows to throw a licensing wobbly. Court documents show Stokes used Windows, allowing investigators to link his physical hardware to internet activity and locations.
Microsoft handed investigators timestamped logs covering Stokes’ web activity, video game history, IP addresses, tool usage including Ngrok, Azure status and more.
Stokes was carrying two hard drives stuffed with incriminating evidence when he tried to board his flight to Japan. His real identity had reportedly been known since 2024.
Because he was then a minor living between Estonia and the UAE, investigators could only monitor him until a time that suited them.
The official criminal complaint includes a Snapchat selfie Stokes allegedly posted while hiding his face behind dozens of hundred-dollar bills. It notes that the wallpaper, carpet and furniture behind him matched New York’s Empire Hotel.
Investigators said Stokes had visited the hotel’s website in Germany before flying to New York.
Following the arrest, Stokes was extradited to the U.S., where he appeared in front of a federal court in Chicago for the first time on June 30, 2026, and he remains in custody.
The accused is awaiting trial after being charged with conspiracy, cyber intrusion and fraud.
