A 20-year-old Florida man linked to the notorious “Scattered Spider” cybercrime group has been sentenced to 10 years in federal prison and ordered to pay $13 million in restitution after pleading guilty to orchestrating a multi-state cryptocurrency theft campaign.
Noah Michael Urban, of Palm Coast, Florida, was handed a 120-month prison sentence on Wednesday by a federal judge, exceeding the prosecution's recommendation of eight years and far surpassing the defense's five-year request. In addition to prison time, Urban will serve three years of supervised release and must forfeit cryptocurrency, cash, and valuables totaling millions of dollars.
Urban pleaded guilty earlier this year to multiple felony charges stemming from two federal cases, one in Florida and another in California. The Florida case involved wire fraud, aggravated identity theft, and conspiracy charges related to SIM swapping attacks that enabled Urban and others to hijack victims' cryptocurrency accounts. Between August 2022 and March 2023, Urban stole at least $800,000 in crypto from five individuals by transferring victims' mobile numbers to phones under his control, allowing him to intercept SMS-based two-factor authentication messages and reset account credentials.
The California case, unsealed in November 2024, accused Urban of participating in a broader phishing campaign that targeted corporate employees using deceptive SMS messages, a tactic known as “smishing.” These messages lured victims to fake login pages that captured credentials, enabling unauthorized access to corporate networks and personal crypto wallets. The Department of Justice said the scheme spanned from September 2021 to April 2023 and led to at least $11 million in cryptocurrency theft. Urban pleaded guilty to one count of conspiracy to commit wire fraud in that case.
Urban, who operated under online aliases such as “King Bob” and “Gustavo Fring,” is believed to be a key figure in Scattered Spider, a loosely organized but highly active cybercriminal group known for targeting major corporations through social engineering, SIM swapping, and phishing. U.S. cybersecurity officials describe the group as skilled at impersonating internal IT staff to gain trust and trick employees into installing remote access tools or handing over credentials and one-time passwords.
Scattered Spider, also tracked under threat actor names like UNC3944 and Scatter Swine, has been implicated in attacks against over 45 organizations worldwide. The group monetizes its access through data theft, ransomware deployment, and crypto theft.
Urban's sentencing is the latest development in a broader law enforcement crackdown on Scattered Spider. In November 2024, the U.S. Department of Justice charged five members of the group, including Urban, for their role in a coordinated phishing and wire fraud campaign. The co-defendants, Ahmed Hossam Eldin Elbadawy (TX), Evans Onyeaka Osiebo (TX), Joel Martin Evans (NC), and Tyler Robert Buchanan (UK), face similar charges, with potential sentences reaching up to 20 years.
Court records reveal that Urban had personally made “several million dollars” from cryptocurrency theft between 2021 and 2023. During a May 2023 interview, he told investigators much of the stolen funds had been lost to online gambling. At the time of his arrest in March 2023, agents seized over $2.89 million in cryptocurrency from Urban's computer, assets that had appreciated to $3.67 million by October 2024 due to market fluctuations. In total, Urban has agreed to forfeit digital assets held in Dai, Ethereum, Monero, Bitcoin, and Ripple, along with $27,702 in cash and luxury items, including jewelry and six watches.
Leave a Reply