Windows Device ID Ties Alleged Scattered Spider Operator Stokes to May 2025 Jewelry Retail Breach

The unsealed complaint details how Stokes, known as Bouquet, created the ngrok tunnel account at 19:21 UTC on May 12 while the same device ID visited the retailer's site three hours later through a shared proxy. Microsoft records matched the ID across Snapchat, Apple, and Facebook accounts attributed to Stokes, corroborated by State Department travel data placing him in Tallinn, New York, and Thailand. The attackers used help-desk social engineering to reset passwords and MFA devices, installed ngrok and Teleport, and attempted ransomware deployment before eviction. No software vulnerability was required.

Group-IB's 2025 assessment frames Scattered Spider as a loose collective of cells under five operators sharing TTPs rather than a hierarchical group, matching the complaint's description of over 100 intrusions and $100 million in ransoms. The device ID survived OS updates but reset on reinstall, exposing how mundane Microsoft telemetry now bridges VPNs, aliases, and travel records in a single operator's case. This mirrors patterns in prior FBI attributions where endpoint artifacts outlast operational security tradecraft.

The retailer's $2 million loss stemmed from process failures at the help desk, not patching gaps. FIDO2 keys and callback verification would have blocked the entry vector regardless of device telemetry. Future investigations will likely surface more device ID matches as Microsoft and similar providers respond to subpoenas, pressuring operators to adopt fresh installs or non-Windows tooling.

Scattered Spider cells are expected to fragment further, with independent actors adopting hardware-level identifiers that change on every boot. Prosecutors will continue leveraging the same telemetry to map travel and account clusters even when proxies obscure network origins.