U.S. extradites alleged Scattered Spider hacker from Finland to face charges

A 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was extradited from Finland to the United States to face federal conspiracy charges tied to the Scattered Spider cybercrime group. He made his first appearance Tuesday in federal court in Chicago and was ordered held in law-enforcement custody.

The criminal complaint was unsealed Tuesday in the Northern District of Illinois and charges Stokes with conspiracy, computer intrusion and fraud. Finnish authorities arrested him in April under an Interpol Red Notice, and U.S. authorities brought him back last week, extending a case that prosecutors say reaches well beyond one suspect and into a sprawling cross-border hacking network.

Assistant Attorney General A. Tysen Duva said the complaint alleges Stokes belonged to a group involved in more than 100 network intrusions that generated more than $100 million in ransom payments and millions more in damages. Prosecutors say Scattered Spider, also known as Octo Tempest, UNC3944 and 0ktapus, used fraudulent pretenses to reach employee accounts, then encrypted or stole company data before demanding cryptocurrency to restore access or prevent leaks.

The case shows how disruptive the group has become for major U.S. companies that rely on employee logins, remote access tools and fast-moving digital operations. By targeting account credentials rather than only attacking software flaws, Scattered Spider has been able to move into corporate systems, lock up data and extract money from victims under pressure to keep businesses running. The complaint says the group repeatedly targeted U.S. companies and organizations, causing widespread disruption, extorting employees and inflicting serious financial losses.

It also highlights how investigators have turned to international cooperation to reach suspects who operate across borders. Finnish police arrested Stokes, the Interpol notice helped bring the case forward, and U.S. authorities then moved him into a Chicago courtroom for prosecution. The filing suggests prosecutors see Scattered Spider as a persistent, organized and profitable enterprise, one that has kept using the same employee-account takeover tactics even as authorities pursue arrests abroad.