Peter Stokes, a 19-year-old dual US-Estonian citizen, was extradited from Finland to face federal charges in Chicago connected to the notorious Scattered Spider cybercrime group. The Department of Justice announced the extradition on July 1, marking another scalp in the government’s slow but steady campaign against one of the most prolific hacking collectives in recent memory.
Stokes made his initial court appearance in the Northern District of Illinois on June 30, where a judge ordered him detained pending further proceedings. He faces charges of conspiracy, computer intrusion, and fraud.
Inside the case against Stokes
Stokes, who allegedly operated under the aliases “Bouquet,” “Spencer,” and “Jordan,” was arrested in April 2026 under an Interpol Red Notice. He is connected to at least four cyber intrusions attributed to the group, including a significant breach of a jewelry retailer in 2025.
The group, which goes by a rotating wardrobe of names including UNC3944, ShinyHunters, 0ktapus, and Octo Tempest, is linked to more than 100 network intrusions. Those breaches have collectively generated over $100 million in ransom payments.
