Noah Urban, a 20-year-old man from Palm Coast, Florida, has pleaded guilty to multiple charges related to his involvement in the notorious cybercrime group known as Scattered Spider.
The group, which has been responsible for high-profile cyberattacks, including ransomware campaigns against major corporations, has made headlines in recent years. Urban, who went by the online aliases ‘Sosa’ and ‘Elijah’, was arrested in January 2024 and the full scope of the charges against him was revealed in November 2024, when US authorities also unsealed charges against four other alleged members of the ring.
Scattered Spider, also known as Starfraud, UNC3944, Scatter Swine, and Muddled Libra, has targeted major companies like MGM Resorts, using ransomware to disrupt operations and steal valuable data. The group is also suspected to be behind the 0ktapus campaign, a large-scale SMS-based phishing operation that has impacted multiple organizations across different sectors.
Urban was charged alongside several others, most of whom are in their early to mid-twenties, for orchestrating phishing attacks that led to the theft of millions of dollars' worth of cryptocurrency. The scheme frequently involved SIM swapping—a method that tricks mobile service providers into transferring a victim’s phone number to a SIM card controlled by the attacker. This technique enables the cybercriminals to bypass two-factor authentication (2FA) and hijack the victim’s online accounts, giving them access to sensitive data and funds.
Though Urban initially pleaded not guilty to the charges, court documents reveal that he reached a plea deal last week in connection with charges filed against him in both California and Florida. As part of the agreement, Urban pleaded guilty to conspiracy to commit wire fraud, wire fraud, and aggravated identity theft. Additionally, he has reportedly agreed to pay $13 million in restitution to 59 victims of his cybercrimes.
