SIM-Swapper, Scattered Spider Hacker Gets 10 Years

A Florida man at the center of a prolific cybercrime group known as “Scattered Spider” has been sentenced to 10 years in federal prison and ordered to pay roughly $13 million in restitution to victims. Noah Michael Urban of Palm Coast, Fla., pleaded guilty in April 2025 to charges of wire fraud and conspiracy.

Florida prosecutors alleged Urban conspired with others to steal at least $800,000 from five victims via SIM-swapping attacks that diverted their mobile phone calls and text messages to devices controlled by Urban and his co-conspirators. The group's methods involved sending phishing emails or texts that tricked employees into entering their credentials and one-time passcodes.

Prosecutors said the targeted SMS scams spanned several months during the summer of 2022, asking employees to click a link and log in at a website that mimicked their employer’s Okta authentication page. The phishing spree netted Urban and others access to more than 130 companies, including Twilio, LastPass, DoorDash, MailChimp, and Plex.

The government says the group used that access to steal proprietary company data and customer information, as well as millions of dollars worth of cryptocurrency. For many years, Urban’s online hacker alias “King Bob” was a fixture of the Com, a mostly Telegram and Discord-based community of English-speaking cybercriminals.

A Brief History of Scattered Spider

Scattered Spider (also known as “Oktapus,” “Scatter Swine” and “UNC3944”) specialized in SMS and voice phishing attacks that tricked employees at victim companies into entering their credentials and one-time passcodes. The group's methods were designed to make it appear as though the employee was receiving legitimate notifications from their employer.

The group gained notoriety for their ability to temporarily move targeted mobile numbers to devices they controlled by constantly phishing employees of major mobile providers. In February 2023, KrebsOnSecurity published data taken from the Telegram channels for Star Fraud and two other SIM-swapping groups showing that these crooks focused on SIM-swapping T-Mobile customers.

Reached via one of his King Bob accounts on Twitter/X, Urban called the sentence unjust, saying that the judge in his case discounted his age as a factor. He also claimed that another Scattered Spider member hacked him personally during the course of his case, leading the judge to ignore his age as a mitigating factor.

A Courtroom Drama

A court transcript from a status hearing in February 2025 shows Urban was telling the truth about the hacking incident that happened while he was in federal custody. It involved an intrusion into a magistrate judge’s email account, where a copy of Urban’s sealed indictment was stolen.

The judge told attorneys for both sides that a co-defendant in the California case was trying to find out about Mr. Urban’s activity in the Florida case. “What it ultimately turned into was a big faux pas,” Judge Harvey E. Schlesinger said. “The Court’s password…business is handled by an outside contractor. And somebody called the outside contractor representing Judge Toomey saying, ‘I need a password change.’ And they gave out the password change. That’s how whoever was making the phone call got into the court.”

Urban will serve 120 months in federal prison and pay $13 million in restitution to victims. He will also undergo three years of supervised release after his sentence is completed.