U.K. Teen Charged in Widespread Cyberattack on U.S. Critical Infrastructure

Federal complaint links London resident to 120 intrusions and $115 million in ransom payments, with New Jersey among impacted jurisdictions

A United Kingdom national has been charged in a newly unsealed federal complaint with orchestrating a series of high-impact cyberattacks against at least 47 U.S.-based entities—including critical infrastructure targets—with activity stretching into New Jersey and beyond.

According to federal prosecutors in the District of New Jersey, 19-year-old Thalha Jubair of London faces multiple counts, including conspiracy to commit computer fraud, wire fraud, and money laundering, in connection with approximately 120 computer network intrusions. The alleged crimes took place between May 2022 and September 2025 and resulted in at least $115 million in ransom payments from U.S. victims attempting to regain control of their systems and prevent the release of stolen data.

The complaint, unsealed on Tuesday, outlines a coordinated campaign by Jubair and unnamed co-conspirators to breach corporate networks using social engineering tactics. Once inside, they allegedly stole, encrypted, and threatened to leak data unless paid. Jubair is also accused of laundering funds obtained from victims, often using cryptocurrency wallets under his control.

Among the more serious allegations, federal authorities say Jubair participated in an October 2024 and January 2025 cyber intrusion targeting a U.S.-based critical infrastructure company and the U.S. Courts system. His involvement is said to include not only data theft and ransom demands but also the handling of proceeds through digital currency.

In July 2024, while law enforcement executed a seizure of a server linked to the scheme—including cryptocurrency valued at $36 million—Jubair allegedly rerouted roughly $8.4 million worth of crypto assets tied to one victim to another wallet. Portions of ransom payments from at least five victims were traced to wallets associated with the server under Jubair's control.

The investigation stems from a broader probe into a cybercriminal organization known by aliases including “Scattered Spider,” “Octo Tempest,” “UNC3944,” and “0ktapus.” This group is believed to have targeted numerous victims across the United States, including entities operating in New Jersey.

Jubair, who also went by online aliases such as “EarthtoStar,” “Brad,” “Austin,” and “@autistic,” was arrested in the U.K. on September 16, 2025, along with another individual, in connection with a separate investigation into an attack on the United Kingdom’s own critical infrastructure.

He faces seven federal charges: conspiracy to commit computer fraud, two counts of computer fraud, conspiracy to commit wire fraud, two counts of wire fraud, and conspiracy to commit money laundering. If convicted on all counts, Jubair could face up to 95 years in prison.

“Jubair is alleged to have participated in a sweeping cyber extortion scheme carried out by a group known as Scattered Spider, which committed at least 120 attacks worldwide and resulted in over $115 million in ransom payments from victims,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division. “These malicious attacks caused widespread disruption to U.S. businesses and organizations, including critical infrastructure and the federal court system, highlighting the significant and growing threat posed by brazen cybercriminals."

The FBI’s Newark Field Office is leading the U.S. investigation, with international cooperation from law enforcement agencies in the U.K., Netherlands, Romania, Canada, and Australia. Prosecutors handling the case include members of the U.S. Attorney’s Office for the District of New Jersey’s Cybercrime Unit and the Department of Justice’s Computer Crime and Intellectual Property Section.

Officials remind the public that a criminal complaint is an allegation and that all defendants are presumed innocent unless and until proven guilty in a court of law.