Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to the United States
Alleged Scattered Spider member Peter Stokes, 19, was extradited from Finland to the U.S.
VERDICT — CONFIRMED
Peter Stokes, a 19-year-old alleged member of the cybercriminal group Scattered Spider, has been extradited from Finland to the United States to face hacking, fraud and extortion charges, per a July 1 US Department of Justice press release. Stokes is known online by the alias “Bouquet,” according to the release.
Prosecutors say Stokes took part in multiple cyberattacks, per the DOJ announcement, whose title describes Scattered Spider as a “criminal cyber hacking group” and states the suspect was arrested in Finland before his transfer to US custody.
The extradition drew same-day coverage from Sky News, BBC News and The Hacker News, the latter identifying the suspect as a 19-year-old Scattered Spider suspect. On the record, per the DOJ: the Finland arrest, the extradition, and the hacking, fraud and extortion charges. The specific intrusions, victims, charging district and potential penalties were not specified in the available summary, and the full DOJ release could not be retrieved for further detail.
Background
Scattered Spider is the name researchers and law enforcement give to a loose, largely English-speaking network of young cybercriminals — many of them teenagers when identified — that has become one of the most consequential threats to Western corporations. The group is best known for social engineering: impersonating employees to help desks, hijacking identities and multi-factor authentication, then deploying ransomware or extorting victims over stolen data. It was linked to the 2023 intrusions that crippled Las Vegas casino operators, among a long series of attacks on major companies.
Because the network is decentralized and its members young and geographically scattered across the US and Europe, law enforcement has pursued it through a rolling series of individual arrests in multiple countries rather than a single takedown. An extradition from Finland fits that pattern of cross-border cooperation, in which allied governments arrest suspects locally and transfer them to the United States, where most of the corporate victims and charges sit.
What comes next
The charges remain allegations pending trial. The procedural next steps are arraignment in the US district where the indictment was filed — not specified in the available material — followed by any detention hearing and the setting of a trial calendar. Charging documents, once public, would be expected to identify the intrusions and victims prosecutors attribute to the defendant.
