Scattered Spider's $89M Ghost Got Caught Ordering Takeout | 2 Minute Drill with Drex DeFord

Hey, everyone. I'm Drex, and this is the Two Minute Drill. It's great to see you today. Here's some stuff you might wanna know about. There's an apartment complex in East London where, like everywhere else, sometimes food is delivered. Shows up at the door. There's a driver and a bag, and they ring the doorbell, and someone grabs their DoorDash or Uber Eats. And nothing about that looks like the end of a global manhunt, but that's where this one ended. Let me tell you about Tala Joubert. He's 19, and for a long stretch, he was kind of a ghost. Online, he went by Earth to Star or sometimes Brad or sometimes Austin. He ran an amnesic operating system, the kind of OS that forgets everything the second that you shut it down, and he routed everything through VPNs. He was careful in a way almost nobody manages to be. Investigators believe he was one of a core group of players in Scattered Spider, the crew behind a run of really vicious attacks, including a bunch of ransomware attacks in US healthcare. There were a total of a hundred and twenty victims. They extorted forty-seven US organizations. Prosecutors said he even had a hand in the attack on the US Federal Court system. And the money was real. Investigators traced eighty-nine and a half million dollars in cryptocurrency to wallets and servers he controlled. Two financial firms alone paid him twenty-five million dollars and thirty-six million dollars in Bitcoin in separate deals. But here's the wall the investigators kept hitting. They could see the wallets. They could watch the money move in real time. They just couldn't put a face and an address to the person who held the keys to those Bitcoin wallets. And then they followed the money to dinner. Joubert pulled crypto out of those same wallets and bought gift cards with it. Those gift cards then were used for food delivery, and he had the food sent to his own apartment complex. Same story with gaming accounts tied to his name. Years of flawless tradecraft and, and an amnesic OS, the VPNs, all the things he did to protect himself, and then the whole thing unraveled because of takeout food. Blockchain analysis walked the money from the ransomware payment right to the guy's front door. Now, what does a 19-year-old in London, why does that person matter to you who's running operations or running security for a health system in Ohio or Texas or Utah? Well, because the people coming after your hospital aren't always who you picture. Some of them are kids with better operational security than any of our average enterprises. They take their time, they're disciplined. They will encrypt your entire network on a Friday night, and they'll never lose a minute's sleep over it. But discipline is exhausting. Nobody keeps it up forever. Joubert was perfect right up until he wasn't, right up until he was hungry. And I know we like to say we have to be perfect all the time, but the bad guys only have to get lucky once, and that's still true. But the good news is, more and more, the bad guys also have to be super disciplined every single day, because when they're not, that's when they get caught. That's it for today's Two Minute Drill. Thanks for being here. Drop me a note and let me know what you're working on. I always happy to hear from you. I'm drex@229project.com. Again, thanks for being here. Stay a little paranoid, and I will see you around campus