Critical infrastructure under siege: Scattered Spider charges underscore cyber threats to physical systems

CAMDEN, N.J. — The arrest and indictment of Scattered Spider hacker Thalha Jubair is sending ripples through both cybersecurity and physical security sectors, as the scope of the group's attacks underscores the growing threat to critical infrastructure and operational continuity. 

Federal prosecutors in the U.S. have charged 19-year-old Thalha Jubair of the U.K. with seven counts, including fraud and money laundering, for allegedly participating in up to 120 network intrusions targeting 47 U.S. entities. 

According to a report released by Flashpoint, a cyber threat intelligence platform: 

“The charges mention specific targets, such as U.S. critical infrastructure companies and the federal court system. Jubair allegedly used social engineering to gain unauthorized access into computer networks, steal and encrypt data, and demand ransom payments totaling US$115 million.” 

The targeting of critical infrastructure and transportation systems—including a cyberattack on Transport for London (TfL)—raises alarms for physical security professionals tasked with protecting facilities, personnel and public safety. 

U.K. authorities have filed their own charges and arrested Jubair and another alleged Scattered Spider member, 18-year-old Owen Flowers, in connection with the TfL incident. 

The charges also coincide with the arrest of a Las Vegas youth last week linked to breaches at Caesars Entertainment and MGM Resorts International, both of which rely heavily on integrated physical-cyber systems such as access control, surveillance and guest safety technologies. 

Flashpoint previously reported that Jubair was the Doxbin owner who attempted to fake their own kidnapping in 2024. Jubair used multiple aliases including "EarthtoStar," "Brad," "Austin," and "Operator"—the latter as Doxbin admin. In May 2025, analysts linked “Operator” to Scattered Spider and multiple ransomware attacks. 

Earlier this month, Scattered Spider posted a message indicating that it was going inactive, stating “that silence will now be our strength.”