Security1 publisher2 min readPublished
A forfeiture order disclosed Ahmed Elbadawy's year-old guilty plea in the Scattered Spider case
Elbadawy is the third of the five people charged in 2024 to be convicted. Prosecutors want at least $17.6 million in cryptocurrency and cash out of a spree the indictment ties to 29 compromised victims.
The Watch · Security desk
What happened
- Ahmed Hossam Eldin Elbadawy, a 24-year-old from Texas, pleaded guilty to wire fraud conspiracy and aggravated identity theft in the Scattered Spider case exactly one year ago.
- The plea stayed off the public record until prosecutors filed an order of forfeiture this week, and the court records carrying it were released Tuesday.
- Federal prosecutors charged five people with links to Scattered Spider in 2024; Noah Urban was sentenced to 10 years last year and Tyler Buchanan pleaded guilty in April and awaits sentencing.
- Officials detailed 29 compromised victims and at least 12 victim companies in entertainment, telecom, technology, business process outsourcing, IT, cloud and virtual currency.
- The forfeiture order seeks Bitcoin valued at more than $14.19 million, Ethereum valued at more than $3.4 million and nearly $63,000 in cash from Elbadawy.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint The pool the FBI describes numbers in the thousands, so a company's protection comes from changes at the credential-issuance step.
- exposure Any company holding data that identifies wealthy employees is a reconnaissance target in this pattern, even when the theft finally lands on an individual's wallet.
- precedent In later Com cases, seizure demands will likely track a defendant's current holdings, and victim restitution comes out of that pool.
- decision A signed plea can sit unpublished for a year, so counsel weighing whether to wait on the criminal case for restitution cannot treat the public docket as current.
The terms of Elbadawy's plea agreement have not been released [3]. What is on the record is the forfeiture list, and it runs past the thefts the indictment itemizes. Cryptocurrency and cash line items total about $17.65 million [18]. The three highest-value thefts charged, nearly $6.35 million in September 2021, $571,000 in June 2022 and nearly $1.7 million in December 2022, total about $8.62 million [10][19]. Prosecutors are asking for roughly twice what they itemized [20]. They also want a lifted golf cart, three luxury vehicles, a painting of Muhammad Ali, luxury watches, gold jewelry, a collection of designer bags and 150 pairs of shoes [9].
Prosecutors charge a two-step access sequence. The crew obtained credentials through social engineering, then used stolen company data to identify high net worth employees whose virtual currency accounts held millions [11]. Money came out of wallets controlled by many of the victims [14]. Only the first step sits under a target company's control; everything after it is the company's own data being read by someone with valid credentials [11]. The three biggest thefts span September 2021 to December 2022, fifteen months on the same entry method [22].
Three of the five people charged in 2024 have now been convicted [21]. Elbadawy awaits sentencing in Southern California, where three of the victim businesses are located [7]. Evans Onyeaka Osiebo and Joel Martin Evans were charged in the same round [4]. The spree the charges cover ran from at least 2021 to 2023 [15].
Scattered Spider draws from a much larger pool. The FBI describes The Com as thousands of members, typically between 11 and 25 years old, splintered into three subsets it calls Hacker Com, In Real Life Com and Extortion Com [16]. CyberScoop wrote that "While early leaders of Scattered Spider have been arrested or sentenced for their crimes, others have filled those roles with even more exceptional impact." [17]
What to watch
- Whether the court unseals the terms of Elbadawy's plea agreement, including any cooperation requirement.
- Sentencing dates for Elbadawy in Southern California and for Tyler Buchanan.
- Any public disposition for Evans Onyeaka Osiebo and Joel Martin Evans, the other two charged in 2024.