A suspected member of the notorious hacking collective Scattered Spider has been taken into U.S. custody following an international extradition operation spanning Finland, Estonia, and the United States.
The arrest marks a significant milestone in the ongoing crackdown against one of the most disruptive cybercriminal groups targeting American enterprises.
Peter Stokes, 19, a dual U.S.-Estonian citizen, faces federal charges of conspiracy, computer intrusion, and fraud following an unsealed criminal complaint in the Northern District of Illinois.
Finnish authorities apprehended Stokes in April under an Interpol Red Notice, and he was extradited to the U.S. last week. He appeared in federal court in Chicago on Tuesday and remains in law enforcement custody pending further proceedings.
Also tracked under aliases including “Octo Tempest,” “UNC3944,” and “0ktapus,” Scattered Spider has been linked to more than 100 network intrusions against U.S. companies.
The group typically gains unauthorized access to employee accounts through social engineering and fraudulent pretenses, then encrypts victim data or exfiltrates it to remote servers before extorting cryptocurrency payments to restore access or prevent data leaks.
According to the Justice Department, these operations have generated over $100 million in ransom payments, with additional millions in collateral damages to victim organizations.
The complaint details a May 2025 incident in which Stokes and co-conspirators allegedly breached a luxury jewelry retailer’s network, exfiltrated sensitive data, and demanded roughly $8 million in cryptocurrency.
Although the retailer’s security team successfully expelled the attackers before any ransom was paid, the company still incurred at least $ 2 million in losses due to business disruption, forensic investigation, and remediation efforts.
Assistant Attorney General A. Tysen Duva of the DOJ’s Criminal Division credited the arrest to sustained multi-year collaboration between the Criminal Division, the U.S.
Attorney’s Office for the Northern District of Illinois, and the FBI. U.S. Attorney Andrew S. Boutros emphasized the broader threat cybercriminals pose to American businesses in his role as Co-Chair of the White Collar, Cyber, and Crypto Subcommittee.
While FBI Cyber Division Assistant Director Brett Leatherman highlighted the bureau’s reliance on strong domestic and international partnerships to pursue actors regardless of where they are located.
The FBI’s Chicago Field Office led the investigation, with support from the FBI’s Copenhagen Legal Attaché Office. Prosecution is being handled by CCIPS Assistant Deputy Chief Adrienne L. Rose alongside Assistant U.S.
Attorneys Jennifer Chang and Ann Marie Ursini for the Northern District of Illinois. The DOJ’s Office of International Affairs coordinated closely with Finland’s National Bureau of Investigation to secure the extradition, and the department publicly acknowledged the Finnish agency’s assistance in the case.
This case falls under Operation Riptide, the FBI’s ongoing initiative targeting the criminal actors, infrastructure, and financial networks behind cybercrime and fraud against Americans.
The timing is notable given that Americans reported over $20 billion in cybercrime losses last year, a 26 percent year-over-year increase.
Since 2020, CCIPS has secured convictions against more than 180 cyber and IP criminals and obtained court orders for the return of over $ 350 million in victim funds.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
