iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Scattered Spider activity was reported during 2025, but the sources summarized here do not establish whether the group remained operational on October 4, 2026. Separately, cybersecurity firm Outpost24 published an assessment about the person it associates with EncryptHub, while two alleged Rydox administrators later had different outcomes in U.S. court: Ardit Kutleshi pleaded guilty in 2026, and Jetmir Kutleshi had pleaded guilty and been sentenced in 2025.
Scattered Spider: activity reported in 2025, later arrest in 2026
What threat researchers observed
In its April 11, 2025 roundup, SecurityWeek reported that Scattered Spider remained active despite arrests and prosecutions. The activity it described was based on observations by threat-intelligence company Silent Push, not independent confirmation that each named organization had been breached.
Silent Push’s April 8, 2025 report listed services including Klaviyo, HubSpot and Pure Storage, and brands including Chick-fil-A, Forbes, Instacart, Louis Vuitton, Morningstar, News Corporation, Nike, X, Tinder, T-Mobile and Vodafone. Its report also named Audemars Piguet, Credit Karma, New York Digital Investment Group and Paxos. These are organizations Silent Push said it observed in connection with its research; the list should not be read as a list of confirmed victims.
Recommended Free Tools
Silent Push said it tracked five phishing kits used since at least 2023 and a new version of Spectre RAT. The company reported that changes to deployments and kits in early 2025 suggested shifts in operators or technical decisions, while saying it continued to track the threat.
#1 Best Overall
Methods described in a 2025 government advisory
A joint advisory published July 29, 2025, by the FBI, CISA, RCMP, Australian Cyber Security Centre, Australian Federal Police, Canadian Centre for Cyber Security and UK National Cyber Security Centre described tactics associated with Scattered Spider. These included helpdesk impersonation and other social engineering to steal credentials, manipulation of multifactor authentication, use of valid accounts, discovery and lateral movement, data exfiltration, and encryption. The advisory cautioned that the group’s tactics evolve; it is a dated description of activity, not evidence of its status in October 2026.
2026 U.S. case update
On July 1, 2026, the U.S. Department of Justice announced that Peter Stokes, 19, a dual citizen of the United States and Estonia, had been arrested in Finland and extradited to the United States. A criminal complaint alleges that he was a Scattered Spider member and participated in conspiracy, intrusion and fraud offenses. The complaint alleges that in May 2025 the group breached a luxury jewelry retailer, exfiltrated data and demanded about $8 million in cryptocurrency. According to DOJ’s account of the allegations, the retailer evicted the actors and paid no ransom, but suffered at least $2 million in disruption, investigation and mitigation losses.
DOJ’s release, summarizing the complaint, also attributes more than 100 network intrusions and more than $100 million in ransom payments, plus millions more in victim damages, to the alleged group. These are allegations, not findings of guilt. Stokes is presumed innocent unless proven guilty.
EncryptHub: what Outpost24 says it identified
SecurityWeek’s 2025 roundup described EncryptHub, also called Larva-208, as apparently operated by a Ukrainian national, citing Outpost24. Outpost24 did not publicly name the person. Its later account linked online activity to the username SkorikARI and said Microsoft credited vulnerability findings under that identity: CVE-2025-24071 and CVE-2025-24061.
Rank #3
Outpost24 characterized its biographical reconstruction as cursory, not exhaustive and unverified. It described operational-security mistakes as investigative clues, including password reuse, exposed server configuration and insecure handling of authentication backup codes. In one exposed file, the firm reported that 82 of 200 accounts had nearly identical passwords; that figure is an example from this investigation, not an estimate about threat actors generally.
The firm also reported seeing the operator use ChatGPT for coding, configurations, writing and translations, based on exposed conversations and files. That account describes activity Outpost24 observed; it does not establish that AI generated every component of EncryptHub’s malware.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Rydox: the administrators’ separate case outcomes
Ardit and Jetmir Kutleshi, Kosovo nationals described by DOJ as alleged Rydox administrators, were extradited to the United States to face charges involving identity theft, access-device fraud and money laundering. Later DOJ updates show that their cases did not end in the same way.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Defendant | Case outcome and timeline | Next step reported by DOJ |
|---|---|---|
| Ardit Kutleshi | DOJ said he was arrested in Kosovo in December 2024 and extradited to the United States in 2025. On September 22, 2026, he pleaded guilty to aggravated identity theft and money-laundering conspiracy. | Sentencing was scheduled for February 9, 2027, according to DOJ’s September 24, 2026 release. |
| Jetmir Kutleshi | DOJ said he had pleaded guilty and been sentenced in December 2025, before being deported to Kosovo. | No later proceeding was stated in the September 24, 2026 DOJ account. |
DOJ said the U.S. government judicially seized the Rydox.cc domain in December 2024. The department attributed more than 7,600 transactions and at least $232,000 in revenue since at least 2016 to court documents; it said the marketplace transactions involved stolen personally identifiable information, access devices, means of identification, and cybercrime tools and services. The revenue figure is DOJ’s later court-document-based account, rather than the at-least-$230,000 figure used in SecurityWeek’s earlier coverage.
Best Value
FBI Cyber Division Assistant Director Brett Leatherman said in DOJ’s September 24, 2026 release: “The FBI and its foreign partners shut the marketplace down, and now the man who created it and ran it pleaded guilty.” The statement referred to Ardit Kutleshi; his sentencing remained pending at the time of the release.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
