SIMSwapper Scattered Spider Hacker Gets 10 Years Krebs on Security

pA 20yearold Florida man at the center of a prolific cybercrime group known as Scattered Spider was sentenced to 10 years in federal prison today and ordered to pay roughly 13 million in restitution to victimsppNoah Michael Urban of Palm Coast Fla pleaded guilty in April 2025 to charges of wire fraud and conspiracy Florida prosecutors alleged Urban conspired with others to steal at least 800000 from five victims via SIMswapping attacks that diverted their mobile phone calls and text messages to devices controlled by Urban and his coconspiratorsppA booking photo of Noah Michael Urban released by the Volusia County SheriffppAlthough prosecutors had asked for Urban to serve eight years Jacksonville news outlet News4Jaxcom reports the federal judge in the case today opted to sentence Urban to 120 months in federal prison ordering him to pay 13 million in restitution and undergo three years of supervised release after his sentence is completedppIn November 2024 Urban was charged by federal prosecutors in Los Angeles as one of five members of Scattered Spider aka Oktapus Scatter Swine and UNC3944 which specialized in SMS and voice phishing attacks that tricked employees at victim companies into entering their credentials and onetime passcodes at phishing websites Urban pleaded guilty to one count of conspiracy to commit wire fraud in the California case and the 13 million in restitution is intended to cover victims from both casesppThe targeted SMS scams spanned several months during the summer of 2022 asking employees to click a link and log in at a website that mimicked their employers Okta authentication page Some SMS phishing messages told employees their VPN credentials were expiring and needed to be changed other missives advised employees about changes to their upcoming work scheduleppThat phishing spree netted Urban and others access to more than 130 companies including Twilio LastPass DoorDash MailChimp and Plex The government says the group used that access to steal proprietary company data and customer information and that members also phished people to steal millions of dollars worth of cryptocurrencyppFor many years Urbans online hacker aliases King Bob and Sosa were fixtures of the Com a mostly Telegram and Discordbased community of Englishspeaking cybercriminals wherein hackers boast loudly about highprofile exploits and hacks that almost invariably begin with social engineering King Bob constantly bragged on the Com about stealing unreleased rap music recordings from popular artists presumably through SIMswapping attacks Many of those purloined tracks or grails he later sold or gave away on forumsppNoah King Bob Urban posting to TwitterX around the time of his sentencing todayppSosa also was active in a particularly destructive group of accomplished criminal SIMswappers known as Star Fraud Cyberscoops AJ Vicens reported in 2023 that individuals within Star Fraud were likely involved in the highprofile Caesars Entertainment and MGM Resorts extortion attacks that same yearppThe Star Fraud SIMswapping group gained the ability to temporarily move targeted mobile numbers to devices they controlled by constantly phishing employees of the major mobile providers In February 2023 KrebsOnSecurity published data taken from the Telegram channels for Star Fraud and two other SIMswapping groups showing these crooks focused on SIMswapping TMobile customers and that they collectively claimed internal access to TMobile on 100 separate occasions over a 7month period in 2022ppReached via one of his King Bob accounts on TwitterX Urban called the sentence unjust and said the judge in his case discounted his age as a factorppThe judge purposefully ignored my age as a factor because of the fact another Scattered Spider member hacked him personally during the course of my case Urban said in reply to questions noting that he was sending the messages from a Florida county jail He should have been removed as a judge much earlier on But staying in county jail is tortureppA court transcript PDF from a status hearing in February 2025 shows Urban was telling the truth about the hacking incident that happened while he was in federal custody It involved an intrusion into a magistrate judges email account where a copy of Urbans sealed indictment was stolen The judge told attorneys for both sides that a codefendant in the California case was trying to find out about Mr Urbans activity in the Florida caseppWhat it ultimately turned into a was a big faux pas Judge Harvey E Schlesinger said The Courts passwordbusiness is handled by an outside contractor And somebody called the outside contractor representing Judge Toomey saying I need a password change And they gave out the password change Thats how whoever was making the phone call got into the courtpp
This entry was posted on Wednesday 20th of August 2025 0947 PM
ppfree sosappJohn what a great idea We should free him Lets do that in say 2035ppThrow sosa into solitaryppAnd deprive him of the company he so richly deservesppToo bad Do the crime do the time Your age is irrelevantppWhy is it that these guys have no problem with loudly boasting about their exploits which do a lot of damage and hurt many people but when they get caught and given a long prison sentence they immediately start whining like babies Any why should a judge take his age into account and give him a lighter sentence Sure hes still only 20 and thats a shame in itself but he knows exactly what hes doingppPoor thing being tortured in a county jail Hes lucky hes not in a state prison instead If you cant do the time dude dont do the crimeppLike Forrest Gump said Stupid is as Stupid Does SirppSo the judge who it seems like legally shouldve recused himself from the case went far above what the prosecutor recommended and didnt give a downward variance for this thief who was arrested at 18 That does seem to be a valid point that the hacker made Why is he being asked to pay restitution to people not involved 10 years for a white collar crime seems excessive when compared to similar white collar crimes and even moreso when looking at murderes and rapists getting less time on average Make that kid use his brain to help the govt not throw him in prison for a decade to rot to make an example out of himppIm sorry but the govt has enough criminals as is They have no need for another one This group was not exploiting something terribly technical but instead used good old social engineering ppI fail to see where this sympathy for the perps comes from These guys arent heroes nor are they hackers in the traditional sense eg driven by curiosityppSo badppSad and now we are going to spend another million on a victimless crime which could be used for restitution because companies cant be bothered to do basic security Quit subsidizing their security programs and youll see it get better overnightppvictimless crime If there are no victims why would you suggest paying restitution Come on man do better than that if youre trying to elicit sympathy for these junior criminalsppNo crime is victimless Just because youre ignorant of the repercusions of a criminal act does not mean there are noneppThats actually not true there are cases where a greater good is being served but the act is still illegal Sure youre generally right about SCAMMERS of courseppF around
Find outppCue the worlds smallest violin playing a sad tune He bragged about victimizing innocent people I hope he meets some nice boyfriends in prisonppSIM swappers phishers and crypto thieves are not hackers they are criminals Im glad to finally see a sentence measured in decades even if its only 1 The impact to victims is sometimes immeasurable and even includes selfdeletion in extreme casesppAnd somebody called the outside contractor representing Judge Toomey saying I need a password change And they gave out the password change Thats how whoever was making the phone call got into the court
If someone calls in for a password change and the person gives them a password please fire them immediately
WTF reset you own password
I will bet the outside contractor still has a jobppHow did he make all of these tweets and contact Krebs if he is in jail I understand its possible to have a burner phone in jail but the Twitter account mentioned here has been tweeting every dayweek for the past yearppI have rule about committing crime Never commit a crime that has a payout of less than a million dollars for every year of possible prison time if I get caught Its kept me out of prison so farppLiterally posting sad cat memes waiting for prison lmaoppThis schmuck is not a hacker He was getting in by smooth talking to some gullible employees of those companies Although I do agree with a poster above that wanted him to be employed by the government instead of throwing him in jail The current administration will definitely benefit from his skills ppOn a serious note what an idiot Why would you hack the account of a judge that is sentencing you Even if its not you personally who is doing it and your brain dead buddy ppHey I hope he has a strong grip on a bar of soap in his new homeppHonestly its a stark reminder it doesnt matter how young or flashy you get thinking you can play with peoples digital lives losing will cost you more than you ever imaginedppBrian Krebs deleted my comments I didnt even say anything bad in them all I did was exercise my free speech rightsppBrian Krebs you are scum for deleting my comment And your website just lost all credibility because you censor comments you dont like even if they are trueppLets hope we dont see you again on this website which has lost all credibilityppI rarely delete comments and its apparent your comment came through this time Probably because your first comment was so full of profanity and invective that it was automagically held for moderation And there it shall stay Thanks for visitingppNot this thoughppYour free speech rights which are actual not a right but a liberty are only protection against the government censoring your speech it does not extend to a private individual removing a post on their private propertyppYou are also not immune from the consequences of your speechppA civil liberty is protection from government
A civil right is protection by governmentppUnderstanding is a three edged sword your side their side and the truth J Michael Straczynski Babylon 5ppFree bobppI have no sympathy for the young man He made a choice and it was a bad one it got him caught up and sent to jail What I find most interesting is if the people that are screaming or asking for his freedom would feel the same if they or a family member was one of his victims Reminds me of the scene from the movie BeeKeeper that woman lost everything after being scammed and took her own lifeppHe is innocent and must be released instantly DppHe was tortured by the law enforcement which made him confess BasturdsppI agree They should lock up Brian Krebs instead He is the evil one DppThis was honestly an interesting article I do believe that due to him knowing what he was getting into he is suffering the consequencesppWasnt this guy found with some inappropriate photos of children on his computer When I read that he received 20 years of probation that was a travesty of justice The prosecutor asked for a fair number at 8 years in my opinion especially for a guy was an admin of a forum that enabled this type of conduct at a WIDE scale worth 20 years Nobody should be arguing that he doesnt deserve justice just my opinion or to be let go It depends on severityppComments are closedppMailing ListppSearch KrebsOnSecurityppRecent PostsppStory CategoriesppWhy So Many Top Hackers Hail from Russiap