2025-09-18 (charged) · US

Scattered Spider: Thalha Jubair charged in New Jersey, 2025

Charged. These are allegations until proven in court.

A complaint unsealed in the District of New Jersey charged Thalha Jubair, a UK national, with conspiracies to commit computer fraud, wire fraud and money laundering. The charges are in relation to at least 120 computer network intrusions and extortion involving 47 US entities, from an investigation into the group known as Scattered Spider, and the complaint alleges that victims paid at least $115 million in ransom payments. The complaint describes calls to victims' helpdesks that got representatives to reset other users' passwords. In a separate UK case, Jubair was sentenced in July 2026 over the 2024 Transport for London attack.

$115M (ransom; The complaint alleges that victims paid at least $115 million in ransom payments.)

Timeline

1. 2022-05-01 The complaint alleges the group's intrusions began around May 2022.
2. 2024-07-01 In July 2024 law enforcement seizes a server the complaint says Jubair controlled, including cryptocurrency then worth about $36 million.
3. 2024-10-03 The complaint alleges the conspirators called a New Jersey company's helpdesk and had a representative reset another user's password.
4. 2025-01-08 The complaint alleges the conspirators contacted the US Courts network helpdesk and had a user's password reset.
5. 2025-09-16 UK authorities arrest Jubair in connection with a separate UK investigation.
6. 2025-09-18 The complaint charging Jubair is unsealed in the District of New Jersey.

Lessons

• Require help desk agents to verify identity through a channel the caller cannot control before any password or MFA reset.
• Alert on password resets followed quickly by new sign-ins, device enrolments or bulk data access.
• Report intrusions and extortion to law enforcement: this investigation drew on information from victim companies.

Scam types: Help desk password and MFA reset impersonation, Data theft extortion · Techniques: Voice phishing (vishing)

Sources

1. DOJ D.N.J.: United Kingdom national charged in connection with multiple cyber attacks, including on critical infrastructure (Law enforcement, primary, accessed 2026-09-24)
2. United States v. Thalha Jubair, criminal complaint (D.N.J.) (Court record, primary, accessed 2026-09-24)