As cited
Citation snapshot as of .
threat intel
Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
Federal prosecutors used a persistent Windows device identifier to link a 19-year-old suspect named Peter Stokes to a Scattered Spider attack on a luxury jewelry retailer in May 2025. Microsoft records traced the device ID from the attacker's persistence account to online accounts associated with the suspect. The connection was revealed in an unsealed federal complaint.
Why it matters: Defenders and forensic teams should understand that Windows device IDs can serve as persistent identifiers connecting threat actors across intrusions and online accounts, making them valuable for attribution and investigation.
- Source published
- First seen by Cybersecurity Tracker