Windows Device ID Helped Authorities Track Scattered Spider Hacking Group Member

Authorities linked a 19‑year‑old member of the Scattered Spider group (Peter Stokes) to a large extortion campaign after tracing a persistent Windows Global Device ID alongside VPN and cloud telemetry. Attackers used social engineering to reset MFA and gain privileged access at Company F, deployed remote tunneling tools (ngrok, Teleport) to bypass perimeter defenses, exfiltrated at least 77 GB of data to Amazon S3, and demanded $8 million; investigators tied this activity to Stokes and to a broader series of over 100 intrusions that generated more than $100M in ransom payments, illustrating how device‑level telemetry can enable attribution.