Alleged Scattered Spider member turns self in to Las Vegas police

A suspected member of the Scattered Spider cybercriminal organization turned themselves in to Las Vegas police last week under accusations that they were behind multiple cyberattacks targeting casinos in the city. 

The Las Vegas Metropolitan Police Department released a brief statement on Friday afternoon confirming that an unnamed juvenile suspect surrendered himself to the Clark County Juvenile Detention Center on September 17. He was booked on several charges related to cyberattacks on multiple Las Vegas casino properties between August 2023 and October 2023, police said.

Those dates line up with ransomware attacks on Caesars Entertainment and MGM Resorts — both of which own multiple casinos and hotels across Las Vegas. 

Las Vegas Police said the attacks were attributed to Scattered Spider and noted that the FBI took over the investigation. 

The unnamed suspect was charged with three counts of obtaining and using the personal information of another person, one count of extortion, one count of conspiracy to commit extortion and one count of unlawful acts regarding computers. 

The Clark County District Attorney’s Office said it is looking to transfer the person to the criminal division, where he will face the charges as an adult. 

The ransomware attack on MGM Resorts cost the company more than $100 million and left thousands of Las Vegas visitors scrambling to deal with widespread technology outages caused by the incident. The attackers also stole sensitive personal information on millions of customers and employees. 

 Members of the group later launched an assault in 2025 on multiple industries — shutting down several airlines, major insurance companies and high-profile retailers from March to July.

The group most recently took credit for a damaging attack on British automotive giant Jaguar Land Rover

Law enforcement agencies have recently stepped up efforts to arrest, charge and convict members of the group. 

Last year, police in the U.K. arrested a 17-year-old for his alleged role in the MGM attack. 

Last week, a U.K. national was arrested in London and concurrently charged by U.S. prosecutors for his involvement in at least 120 attacks launched by Scattered Spider. 

Other members of the group were recently slapped with years-long prison sentences for launching attacks.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

Auto giant Stellantis investigating data breach following ‘unauthorized access’

Next Post

BadIIS Malware Spreads via SEO Poisoning — Redirects Traffic, Plants Web Shells

Related Posts

SonicWall Confirms State-Sponsored Hackers Behind September Cloud Backup Breach

SonicWall has formally implicated state-sponsored threat actors as behind the September security breach that led to the unauthorized exposure of firewall configuration backup files. "The malicious activity – carried out by a state-sponsored threat actor - was isolated to the unauthorized access of cloud backup files from a specific cloud environment using an API call," the company said in a
Read More

RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware

The threat actors behind a malware family known as RomCom targeted a U.S.-based civil engineering company via a JavaScript loader dubbed SocGholish to deliver the Mythic Agent. "This is the first time that a RomCom payload has been observed being distributed by SocGholish," Arctic Wolf Labs researcher Jacob Faires said in a Tuesday report. The activity has been attributed with medium-to-high
Read More

TA558 Uses AI-Generated Scripts to Deploy Venom RAT in Brazil Hotel Attacks

The threat actor known as TA558 has been attributed to a fresh set of attacks delivering various remote access trojans (RATs) like Venom RAT to breach hotels in Brazil and Spanish-speaking markets. Russian cybersecurity vendor Kaspersky is tracking the activity, observed in summer 2025, to a cluster it tracks as RevengeHotels. "The threat actors continue to employ phishing emails with invoice
Read More