A 19-year-old U.K. national is facing a potential 95-year prison sentence after being charged in connection with a sprawling international cybercrime and extortion scheme that targeted critical U.S. infrastructure, businesses, and even the American court system.
Authorities say Thalha Jubair — known online by aliases including “EarthtoStar,” “Brad,” and “Austin” — was part of a notorious hacking collective known as “Scattered Spider,” also referred to as “Octo Tempest” and “0ktapus.” The U.S. Department of Justice alleges Jubair and co-conspirators carried out at least 120 network intrusions between May 2022 and September 2025, breaching the systems of 47 U.S. entities, stealing data, encrypting it, and demanding ransom payments in exchange for restoring access and suppressing leaks.
Investigators say the group netted more than US$115 million in ransom, with portions traced to cryptocurrency wallets allegedly controlled by Jubair. In one instance, while law enforcement was seizing a server in July 2024, Jubair allegedly moved US$8.4 million in crypto to another wallet.
The global investigation was led by the FBI with support from the RCMP, as well as law enforcement agencies in the Netherlands, Romania, and Australia. U.S. officials say the targets included a major critical infrastructure company and the U.S. court system, attacks that underscore the growing national security threat posed by ransomware groups.
Jubair faces charges including conspiracy to commit computer fraud, wire fraud, and money laundering. None of the allegations have been proven in court.