Two young men, key operatives in the notorious cybercrime syndicate Scattered Spider, have dramatically altered the course of their anticipated six-week trial in the United Kingdom by pleading guilty on its very first day. This pivotal development stems from a devastating August 2024 cyberattack that brought Transport for London (TfL), the sprawling public transportation network serving the Greater London area, to its knees. The guilty pleas from 20-year-old Thalha Jubair of East London and 18-year-old Owen Flowers of Walsall mark a significant victory for law enforcement and a stark warning to the cybercriminal underworld.

The charges to which Jubair and Flowers admitted guilt are serious: conspiring to commit unauthorized acts against TfL computer systems and causing risk of serious damage to human welfare. The gravity of their actions extends far beyond the disruption of London’s transit. The BBC reported that Flowers, acting alone, also confessed to his involvement in a conspiracy to breach the computer systems of U.S.-based healthcare giants SSM Health Care Corporation and Sutter Health in September 2024. This dual admission highlights the far-reaching and indiscriminate nature of Scattered Spider’s operations.

Thalha Jubair is no stranger to the attention of U.S. law enforcement. In September 2025, a federal indictment unsealed in New Jersey laid bare the extent of his alleged criminal enterprise. Prosecutors accused Jubair and his Scattered Spider cohorts of perpetrating computer fraud, wire fraud, and money laundering through an astonishing 120 network intrusions targeting 47 U.S. entities between May 2022 and September 2025. The financial toll of these attacks was immense, with victims reportedly paying out at least $115 million in ransom demands.

This latest development is not the first time Flowers and Jubair have been in the crosshairs of authorities. In July 2025, KrebsOnSecurity reported on their arrests in the UK in connection with Scattered Spider’s brazen ransomware attacks against prominent British retailers, including Marks & Spencer, Harrods, and the Co-op Group. Sources close to those investigations revealed that Owen Flowers was, in fact, the individual who anonymously granted interviews to the media in the immediate aftermath of the group’s September 2023 ransomware onslaught that crippled operations at the Las Vegas casinos operated by MGM Resorts and Caesars Entertainment. His willingness to speak to journalists, even while evading capture, underscores a degree of arrogance and a desire for notoriety within the cybercrime ranks.

The prosecution’s case paints a detailed picture of Jubair’s central role in fostering criminal networks. Prosecutors assert that Jubair co-managed a highly active Telegram channel known as "Star Chat." This platform served as a hub for a sophisticated SIM-swapping operation. Through a combination of voice and SMS-based phishing attacks, the group illicitly obtained credentials from employees of major wireless providers in both the U.S. and the UK. This access allowed them to offer a dangerous service: rerouting a target’s phone number to a device under the attackers’ control. This effectively granted them the ability to intercept all incoming calls and text messages, crucially including one-time codes used for multi-factor authentication, thereby bypassing crucial security measures. The accompanying image, a receipt from "Star Fraud Chat" detailing a SIM-swapping service targeting a T-Mobile customer, vividly illustrates the operational mechanics and the hacker handle "Rocket Ace," one of Jubair’s aliases according to U.S. prosecutors.

New Jersey prosecutors have also linked Jubair to a massive SMS phishing campaign conducted during the summer of 2022. This extensive operation targeted employees at hundreds of companies, successfully harvesting single sign-on credentials. The repercussions of this campaign were dire, leading to intrusions and data thefts at over 130 organizations, including well-known names like LastPass, DoorDash, Mailchimp, Plex, and Signal. The sheer scale of this operation demonstrates Scattered Spider’s ability to compromise a wide array of critical digital infrastructure.

Further compounding Jubair’s alleged criminal history, KrebsOnSecurity previously reported that at the tender age of 15, one of his online personas was "Everlynn." Under this guise, the young hacker sold fraudulent "emergency data requests." These requests, cleverly disguised and utilizing compromised police and government email addresses, were sent to major tech companies demanding subscriber data such as usernames and IP/email addresses. The attackers would falsely claim these demands concerned urgent life-or-death matters that could not await a court order, exploiting the urgency and authority of official channels for illicit gain.

The guilty pleas of Flowers and Jubair are part of a broader legal crackdown on Scattered Spider. In April 2026, Tyler Buchanan, a 24-year-old British national and another member of Scattered Spider, pleaded guilty to wire fraud conspiracy and aggravated identity theft for his participation in the group’s 2022 SMS phishing spree. The government stated that Buchanan, Jubair, and others leveraged the credentials obtained during that campaign to steal at least $8 million in cryptocurrency from victims across the United States. Buchanan is currently awaiting sentencing on October 2.

Earlier, in August 2025, Noah Michael Urban, a 20-year-old Scattered Spider member from Florida, received a substantial 10-year federal prison sentence and was ordered to pay $13 million in restitution after pleading guilty to wire fraud and conspiracy charges. His sentence reflects the severe consequences for those involved in large-scale cybercriminal activities.

The U.S. Department of Justice continues to pursue other alleged Scattered Spider operatives. Three defendants indicted alongside Buchanan—Ahmed Hossam Eldin Elbadawy, 24, from College Station, Texas; Evans Onyeaka Osiebo, 21, from Dallas, Texas; and Joel Martin Evans, 26, from Jacksonville, North Carolina—still face charges. These ongoing prosecutions underscore the persistent efforts to dismantle the Scattered Spider network and bring all its members to justice.

For Owen Flowers and Thalha Jubair, the immediate future holds further legal proceedings. They are scheduled to be sentenced in a London court on July 15, 2026, marking the final chapter in this particular phase of their criminal careers. Their guilty pleas, however, represent a significant blow to Scattered Spider and a testament to the tireless work of law enforcement agencies in both the UK and the U.S. in combating the growing threat of sophisticated cybercrime. The swift admission of guilt by these young hackers, on the very first day of their trial, suggests a recognition of the overwhelming evidence against them and perhaps a strategic decision to mitigate further legal repercussions. The case serves as a stark reminder that the digital realm, while offering opportunities, also harbors significant dangers, and that the architects of online disruption will ultimately face accountability.