Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

U.S. prosecutors allege a Scattered Spider-linked operator used help-desk social engineering to reset MFA and gain admin access to a luxury retailer in May 2025, installing ngrok and Teleport to exfiltrate ~77 GB, attempt ransomware, and demand $8M; investigators traced a persistent Windows Global Device Identifier to an accused individual (Peter Stokes), illustrating how device IDs, account links, and travel/ IP data led to an arrest while the broader, loosely organized Scattered Spider activity persists.