Scattered Spider is the name security firms gave to a loose group of young, mostly English-speaking intruders. The charging documents in these cases, and the reporting that followed them, describe one method: phishing employees by text message, swapping SIMs and talking their way past help desks, and from 2022 onward the targets were some of the largest companies in the United States and Britain. We took every alias and mailbox that appears in a charging document or in named reporting for sixteen charged people, ran each through a username search across about 760 platforms and an email lookup across about 175, then followed linked accounts one hop further: 173 searches in one morning. Four of the sixteen produced a profile that carries a name or a persona consistent with the record. The other twelve produced noise, squatters or nothing, and the nothing is often the more interesting part.
The C.D. Cal. caption prints the handles next to the legal names, with no alias at all against Osiebo. First Superseding Indictment, USA v. Buchanan, Elbadawy, Osiebo and Evans, C.D. Cal., ECF 61. Public record, PACER via CourtListener.
The people behind the name were charged one at a time: a November 2024 indictment in Los Angeles against five men, a Seattle indictment over the Snowflake extortions, a New Jersey complaint against a London teenager, a Chicago complaint against a dual US-Estonian national, and the Transport for London prosecution in Woolwich Crown Court. Brian Krebs has covered nearly every step, and much of what the public knows about who used which handle comes from his reporting rather than from the filings. Every seed is public record and we did no unmasking; the four findings below add profile data to attributions that prosecutors and reporters made first.
Who is in the map, and what the record says
Only charged or convicted people are in scope: no unnamed co-conspirators, no victims, no minors, and nobody journalists have identified but no prosecutor has charged. Status is as of 18 September 2026.
The Seattle indictment is where "judische" and "ellyel8" enter the record, and where the lowercase L in ellyel8 can be read off the page instead of guessed. Indictment, USA v. Moucka and Binns, W.D. Wash., Document 1. Public record, Document 1 as published by CyberScoop.
| Person | Public status | Swept | What the sweep added |
|---|---|---|---|
| Joel Martin Evans | Pleaded guilty; sentenced 27 Aug 2026, 24 months | 1 alias, 1 mailbox, 10 variants | two GitLab accounts displaying his name |
| Evans Onyeaka Osiebo | Sentenced 14 Aug 2026, 45 months | nothing printed | not searchable |
| Ahmed Hossam Eldin Elbadawy | Pleaded guilty; awaiting sentencing | 1 two-letter alias | 271 strangers |
| Tyler Robert Buchanan | Pleaded guilty 17 Apr 2026; sentencing 29 Sep 2026 | 4 aliases, 13 variants and pivots, 1 mailbox at zero | borrowed pop-culture names; mailbox at zero |
| Noah Michael Urban | Sentenced Aug 2025, ten years | 5 aliases | the highest squatter count in the set |
| Connor Riley Moucka | Pleaded guilty 5 Aug 2026; sentencing in October | 4 aliases, 13 variants and pivots | a two-account persona on the caption alias |
| Cameron John Wagenius | Pleaded guilty July 2025; sentencing 25 Sep 2026 | 8 aliases, 23 variants and pivots | headline handle nearly absent; one disconfirmation |
| James Thomas Andrew McCarty | Sentenced June 2024, seven years, swatting | 2 aliases, 1 pivot | a real-name resale profile on a rare alias |
| Thalha Jubair | UK: sentenced 16 Jul 2026, five years six months; US complaint outstanding | 12 aliases, 10 variants and pivots | a package-registry chain; custody-era squatters |
| Owen David Flowers | UK: sentenced 16 Jul 2026, five years six months | 7 reporter-printed aliases, 2 pivots | nothing attributable |
| John Erin Binns | Charged Oct 2024; no US appearance | 2 aliases | a username put up for auction |
| Peter Stokes | Charged by complaint; extradited June 2026 | 3 aliases, 2 mailboxes, 2 pivots | four registrations on the mailbox |
| Remington Goy Ogletree | Charged by complaint Oct 2024; no public disposition | 1 alias, 12 mailboxes | eleven dead mailboxes, one live |
| three defendants in an adjacent SIM-swap indictment | Charged Feb 2024 | 6 aliases | nothing; not named here |
Binns, Stokes and Ogletree are charged and not convicted; the conduct in their filings is alleged, and they are presumed innocent. Everything in the right-hand column is presence and profile data. Presence on a platform is never proof that the defendant owns the account. We say that once, here.
Filed under seal in Chicago in December 2025 and unsealed only after the extradition from Finland, the caption prints three names for one person. Criminal Complaint, USA v. Peter Stokes, N.D. Ill., Document 1. Public record, PACER via CourtListener.
Four findings that add something
Evans. The Los Angeles indictment prints one alias for him. A username search on it returns a GitLab profile created in September 2017 with the display name "Joel Evans". The same search on the alias with a single digit appended returns a second GitLab profile, created March 2019, with the same display name. Around both sits a 2016 to 2021 cohort on Twitch, GOG, TypeRacer, chess.com, Keybase and a Minecraft server forum. The Evans post has the full table. Two independent name assertions, one on the exact court alias and one on that alias with a digit appended, make the strongest handle-only result in the set. Display names are self-typed, and "Joel Evans" is not a rare name.
McCarty. His alias is court-sourced: the government's sentencing memorandum records that he admitted the username to the FBI. It is rare enough that almost every hit is an exact match. A resale-marketplace profile on it, created January 2020, displays "James Mccarty". A streaming profile on the same handle, created January 2019, carries a bio written in the idiom of the swatting scene his case describes. A messaging-app profile shows "James". Krebs reported the sentence: seven years, June 2024, for hoax calls that drew armed police responses. It is the one place in the sweep where four signals land on one string. The surname is self-typed and not rare. One further account on the alias, on a social game platform, was created in September 2024, three months after sentencing, with a bio that taunts him about being swatted. That is a squatter or a mockery account and we treat it as someone else's.
The only US filing that puts "Aspertaine" in the record: an admission to the FBI, quoted back at sentencing. Government's Sentencing Memorandum, USA v. McCarty, D. Ariz., ECF 17. Public record, PACER via CourtListener.
Moucka. The Seattle indictment prints four handles among its aliases, and one of them is distinctive. A username search on it and on its separator variant returns two microblog accounts, one created in 2014, that wear one self-described hacker persona: the same invented surname in both display names, a bio about anime and "popping root on your box", a personal chat address, and two personal domains in the website fields. A third account on the same alias, on a game stats site, lists both microblog handles as contacts. We are not printing the persona name, the chat address or the domains. This is a persona match, not an identification. Nothing in the three profiles names Moucka, his town or his country, and two other accounts on the same string claim Indonesia and Moscow. No platform we cover speaks the chat address's protocol, so the one anchor that could close the loop is untestable here. Both domains, swept as usernames, resolved to unrelated people.
Jubair. The New Jersey complaint prints four aliases; Krebs reports several more, including one he ties to leaked group chats. That reporter-only alias resolves, through a package registry, to an author page that publishes a contact mailbox. An email lookup on that mailbox resolves it to two identity providers, an avatar service and a blogging platform, that report the same display name, and to a social account registered to it. It is the only complete alias-to-package-to-mailbox-to-two-providers chain the sweep produced, and nothing in it names him; the display name restates the handle. The premise that the package author is Jubair is the reporter's, and it does not appear in the charging document.
Thalha Jubair. Photograph: National Crime Agency, released with the July 2026 sentencing announcement. Crown copyright, reproduced for reporting on that case.
The disconfirmations and the squatters
Three results argue against a simple reading.
Krebs prints two spellings of one handle for Wagenius in adjacent sentences. Both resolve to accounts on a children's coding platform whose stated country is the United Kingdom, one created January 2018 and one February 2024. Wagenius was a US Army soldier stationed in Texas when arrested. Locations on that platform are self-declared and easy to get wrong, so this weakens the attribution without refuting it.
Jubair was arrested in London on 16 September 2025, remanded two days later and sentenced in July 2026. An Instagram account on his DOJ-printed alias was created on 1 September 2025, two weeks before the arrest, and was last active on 20 October 2025, a month into his remand. A chess account on the same alias was created on 5 August 2026, after the sentence. The creation of the Instagram account sits outside custody; the October activity on it, and the whole of the chess account, sit inside it. The conclusion is "not him", and it applies to every account on that alias with a post-arrest date.
New Jersey, not New York: the complaint caption prints four aliases, one of them a Telegram handle carried straight into the case name. Criminal Complaint, USA v. Thalha Jubair, D.N.J. Public record, complaint as published by Ars Technica.
Binns was indicted in October 2024 and a bench warrant followed the next day; no US filing since establishes where he is. The Telegram username Krebs attributes to him as a persona appears in the Telegram username auction system with a listing date of 5 July 2026, twenty-one months after the indictment. A listing shows that a username exists in the auction system, not who listed it, and the listing date is the marketplace's, unverified; lapsed usernames are listed by strangers all the time. His more distinctive indictment alias returned nothing at all.
Across the group, about one account in nine on a published alias was created after that person's charge date: 11 percent for the 2023 and 2024 cohorts, 6 percent for the 2025 cohort, where less time has passed. The concentration is worst on the headline aliases. Urban's two most-reported handles carry 22 and 19 post-charge creations, and he has been in custody since January 2024. Any future hit on those strings should be assumed to belong to someone else until shown otherwise.
The negatives as evidence
Twenty-six mailboxes went through the email lookup and fourteen returned zero platforms. The zeroes cluster. Eleven of the fourteen belong to Ogletree, whose New Jersey complaint enumerates the mailboxes it says registered the phishing infrastructure: mostly keyboard-mash local parts, mostly on small free-mail domains and one on a mainstream provider, each apparently used once and never attached to a consumer account. The one Ogletree mailbox that lit up is the one the complaint says he admitted to the FBI, and its six hits (Microsoft, Pinterest, Tumblr, Patreon, Disney+, TikTok) look like one ordinary consumer inbox. Evans' reporter-printed mailbox returned seven platforms; Stokes' complaint-printed mailbox returned four.
The registrant block the complaint itself calls "random sequences of letters typed on a keyboard," which is exactly why it sweeps to nothing. Criminal Complaint, USA v. Ogletree, D.N.J., Document 1, paragraph 19. Public record, PACER via CourtListener.
Our reading: charging documents that print infrastructure registrant mailboxes yield burners, and charging documents that print a defendant's own mailbox yield live consumer accounts. A zero here is a zero against 175 platforms, and several of Ogletree's domains are providers no lookup covers. Even so, eleven clean zeroes is what disciplined burner practice looks like from outside.
Handles go quiet too. Wagenius' headline handle, in the news since November 2024, returned two hits across 760 platforms. Buchanan's one court-established selector, a domain registrar username, returned seven old registrations on a comedian joke and nothing tying them to the Scottish town reporters give for him, and the mailbox the record attaches to that registration returned zero.
What the group looks like as a whole
Seventy-seven percent of the effective hits in this sweep, 9,973 of 12,979, sit on 39 identifiers that are dictionary words, first names or public-figure surnames: brad, austin, jordan, spencer, holy, halo, bomb, cute, elijah, sosa, remi, clark, miku, couch, carti, moscow, waifu, tyler. None of those hits is attributable to anybody, and that is the dominant fact about this group. Two defendants have a two-character alias as their only published selector, and Osiebo, sentenced to 45 months, has no printed alias anywhere. Of the 98 distinctive identifiers, every one returned at least one hit and 57 returned five or more, and still only four people produced a profile that clears the bar.
The platform mix says something about where these people grew up online. Among non-noise hits the recurring families are social and short-video, gaming identity (Xbox, Twitch, a Halo stats tracker, Minecraft name histories, chess.com, Scratch) and developer chrome (GitHub, Telegram's auction system). The Minecraft server family is the signature: it shows up in the Evans, McCarty, Wagenius and Moucka clusters alike, which fits the published account of the Com recruiting out of Minecraft communities.
Creation dates tell a quieter story. Of 1,256 dated accounts on non-noise aliases, the distribution runs from 1998 to 2026 with a broad plateau from 2015 to 2023 and peaks in 2021, 2022 and 2018. Only 14 percent were created inside the person's own offending window. This is the age profile of the handles, not of the defendants: the strings are old and widely held, and the offending years are a narrow slice of them. Where a distinctive handle does sit inside the window, as one of Wagenius' does on X in May 2023, it is suggestive at most.
The information does not put the handles in the caption; it spends a paragraph on them instead, and says the list is not exhaustive. Information, USA v. Wagenius, W.D. Wash., Document 1, paragraph 3. Public record, PACER via CourtListener.
Sourcing is the last pattern. Every person-level selector in this map traces back to a US charging document or to Krebs. The National Crime Agency, the Crown Prosecution Service, Europol and Eurojust print names, ages, towns and sentences, and no alias, mailbox or handle. That is why Flowers, convicted and sentenced to five and a half years, is a complete null here: every identifier for him comes from reporting, five of the seven are one-word Telegram names, and the distinctive one resolves to a 2001 eBay account and a payment app in someone else's name. The UK lane tells you who and how long. The US lane and the journalists tell you which string to search.
How to run this yourself
Start from a document that already prints the identifier. Run the email lookup on each mailbox first and note which platforms returned a handle or a display name and which returned a bare registration. Run the username search on every alias and on every spelling variant the sources disagree about; two of the strongest results above came from a variant. Use the cross search to pivot from a returned handle or website field, and let the investigation view stack the pivots so a reviewer can see which seed produced which profile. Sort by creation date, flag everything after the charge date, and export the set with your negatives written down next to your positives. Plans are on the pricing page.
Limits
All of this is presence and profile data. A hit means a string is registered on a platform; the display names, locations and bios are whatever the account holder typed. Counts drift by one or two between identical runs, and about 49 platform checks per search failed upstream, so a zero with 76 failures is weaker than one with 35. Platforms outside the 760 and 175 we cover, and any account that is private, deleted or renamed, are invisible to this method. We ran no breach lookups and report none. Four leads reached the bar we set, and each deserves an independent second pass before anyone relies on it. The prosecutors and reporters did the identification; this post shows the shape of the public footprint around the identifiers they printed.
