A 19-year-old British national faces up to 95 years in prison for allegedly orchestrating cyber attacks that extorted $115 million from 47 U.S. companies.
Thalha Jubair was charged Thursday in New Jersey federal court. The case reveals the global reach of ransomware gangs targeting American businesses and critical infrastructure. It also shows how international law enforcement cooperation can track down cybercriminals who believe they operate beyond borders.
Prosecutors allege Jubair participated in 120 computer network intrusions worldwide as part of the notorious Scattered Spider hacking group. The gang used social engineering tactics to breach company networks, steal data, and demand ransom payments.
“These malicious attacks caused widespread disruption to U.S. businesses and organizations, including critical infrastructure and the federal court system,” said Acting Assistant Attorney General Matthew Galeotti.
The complaint details attacks dating from May 2022 to September 2025. Victims included a U.S. critical infrastructure company and the federal court system, both of which were targeted between October 2024 and January 2025.
Jubair allegedly operated under multiple aliases, including “EarthtoStar,” “Brad,” “Austin,” and “@autistic.” He controlled cryptocurrency wallets that received portions of ransom payments from at least five victims.
In a brazen move, Jubair transferred $8.4 million in cryptocurrency while law enforcement was actively seizing his server in July 2024. Authorities managed to recover $36 million in digital currency during that operation.
“If you attack American companies or citizens, we will find you, we will expose you, and we will seek justice,” said FBI Cyber Division Assistant Director Brett Leatherman.
The investigation involved agencies from the UK, the Netherlands, Romania, Canada, and Australia.
UK authorities arrested Jubair on Tuesday in connection with a separate investigation into attacks on British critical infrastructure. A second individual was also detained.
The charges include computer fraud conspiracy, wire fraud conspiracy, and money laundering conspiracy. Scattered Spider, also known as “Octo Tempest” and “UNC3944,” has become one of the most prolific ransomware groups targeting U.S. entities.