A 23-year-old from Scotland believed to participate in the Scattered Spider hacking collective has been brought to the United States following extradition proceedings in Spain. Buchanan now confronts federal charges encompassing wire fraud, conspiracy, and identity theft. Prosecutors in the U.S. contend that Buchanan worked alongside others to breach numerous organizations across the United States and internationally, with Buchanan personally overseeing access to funds exceeding $26 million obtained from targeted victims.
Scattered Spider operates as a loosely organized criminal hacking network responsible for breaching and extracting information from some of the world's most prominent technology enterprises. The FBI apprehended Buchanan in Spain based on a warrant tied to text message-based phishing operations conducted in summer 2022, which resulted in unauthorized access to systems at Twilio, LastPass, DoorDash, Mailchimp, and numerous additional technology companies.
According to reporting initially published by KrebsOnSecurity, Buchanan, operating under the alias "tylerb," departed the United Kingdom in February 2023 following an incident in which members of a competing criminal organization hired individuals to break into his residence, physically harm his mother, and make threats involving a blowtorch in an attempt to obtain his cryptocurrency wallet credentials. Law enforcement detained Buchanan in June 2024 at Palma de Mallorca airport as he prepared to board a flight bound for Italy. Bloomberg first disclosed his subsequent extradition to the United States.
Although Scattered Spider participants have been connected to the 2023 ransomware incidents targeting MGM and Caesars casinos in Las Vegas, Buchanan's involvement in those attacks remains unconfirmed. The Justice Department's legal filing against Buchanan contains no reference to the 2023 ransomware operations.
The investigation appears to concentrate on the 2022 text message phishing operations and SIM-swapping incidents that extracted cryptocurrency from individual investors. SIM-swapping involves transferring a target's phone number to a device controlled by the attacker, enabling interception of text communications and phone calls directed to the victim—including authentication codes and password recovery messages transmitted through SMS.
During August 2022, KrebsOnSecurity examined information obtained through an extended criminal operation by Scattered Spider comprising extensive text message phishing attempts directed at staff members at major corporations. Security researchers at Group-IB assigned them an alternative designation—0ktapus—reflecting the group's practice of impersonating the Okta identity provider in phishing communications sent to workers at compromised organizations.
The legal complaint against Buchanan indicates that the FBI connected him to the 2022 text message phishing operations after identifying an identical username and email address utilized to establish multiple Okta-themed phishing websites associated with the operation. NameCheap, the domain registrar, determined that roughly one month before the phishing campaign commenced, the account responsible for registering these domains accessed the system from an internet address located in the U.K. Scottish law enforcement informed FBI investigators that this address was rented to Buchanan spanning January 26, 2022 through November 7, 2022.
During a search of Buchanan's residence, authorities recovered no fewer than 20 computing devices. Investigators discovered login information for staff at three organizations that were targeted in the phishing operation stored on one of these devices.
The FBI's investigation to date has gathered evidence showing that Buchanan and his co-conspirators targeted at least 45 companies in the United States and abroad, including Canada, India, and the United Kingdom. One of Buchanan's devices contained a screenshot of Telegram messages between an account known to be used by Buchanan and other unidentified co-conspirators discussing dividing up the proceeds of SIM swapping.
FBI complaint
Prosecutors assert that information retrieved from Discord demonstrated that the same U.K. internet address operated a Discord account that included a cryptocurrency wallet address when requesting another individual to transmit funds. The complaint indicates that the transaction record accessible to the public for that payment address documents approximately 391 bitcoin transferred into and out of the address spanning October 2022 and February 2023; the current valuation of 391 bitcoin exceeds $26 million.
During November 2024, prosecutors in Los Angeles made public criminal charges against Buchanan and four additional suspected Scattered Spider participants: Ahmed Elbadawy, 23, from College Station, Texas; Joel Evans, 25, from Jacksonville, North Carolina; Evans Osiebo, 20, from Dallas; and Noah Urban, 20, from Palm Coast, Florida. KrebsOnSecurity previously reported that a 17-year-old suspect from the United Kingdom connected to Scattered Spider was apprehended as part of a collaborative investigation between the FBI and other authorities examining the MGM breach.
Buchanan's court-provided legal representative declined to provide a statement. Buchanan faces charges including wire fraud conspiracy, conspiracy to acquire information through computer systems for private financial benefit, and aggravated identity theft. The aggravated identity theft charge carries a mandatory minimum incarceration period of two years.
Court filings from the U.S. District Court serving the Central District of California show that Buchanan is detained without the possibility of bail as his case proceeds toward trial. A preliminary hearing has been scheduled for May 6.
Source: Krebs on Security