A 20-year-old Florida man on the heart of a prolific cybercrime group generally known as “Scattered Spider” was sentenced to 10 years in federal jail right this moment, and ordered to pay roughly $13 million in restitution to victims.
Noah Michael City of Palm Coast, Fla. pleaded responsible in April 2025 to prices of wire fraud and conspiracy. Florida prosecutors alleged City conspired with others to steal at the least $800,000 from 5 victims by way of SIM-swapping assaults that diverted their cell phone calls and textual content messages to gadgets managed by City and his co-conspirators.
A reserving picture of Noah Michael City launched by the Volusia County Sheriff.
Though prosecutors had requested for City to serve eight years, Jacksonville information outlet News4Jax.com studies the federal decide within the case right this moment opted to condemn City to 120 months in federal jail, ordering him to pay $13 million in restitution and bear three years of supervised launch after his sentence is accomplished.
In November 2024 City was charged by federal prosecutors in Los Angeles as considered one of 5 members of Scattered Spider (a.ok.a. “Oktapus,” “Scatter Swine” and “UNC3944”), which specialised in SMS and voice phishing assaults that tricked workers at sufferer corporations into coming into their credentials and one-time passcodes at phishing web sites. City pleaded responsible to at least one rely of conspiracy to commit wire fraud within the California case, and the $13 million in restitution is meant to cowl victims from each circumstances.
The focused SMS scams spanned a number of months in the course of the summer time of 2022, asking workers to click on a hyperlink and log in at a web site that mimicked their employer’s Okta authentication web page. Some SMS phishing messages instructed workers their VPN credentials have been expiring and wanted to be modified; different missives suggested workers about adjustments to their upcoming work schedule.
That phishing spree netted City and others entry to greater than 130 corporations, together with Twilio, LastPass, DoorDash, MailChimp, and Plex. The federal government says the group used that entry to steal proprietary firm knowledge and buyer info, and that members additionally phished individuals to steal thousands and thousands of {dollars} price of cryptocurrency.
For a few years, City’s on-line hacker aliases “King Bob” and “Sosa” have been fixtures of the Com, a principally Telegram and Discord-based group of English-speaking cybercriminals whereby hackers boast loudly about high-profile exploits and hacks that just about invariably start with social engineering. King Bob always bragged on the Com about stealing unreleased rap music recordings from well-liked artists, presumably via SIM-swapping assaults. Lots of these purloined tracks or “grails” he later bought or gave away on boards.
Noah “King Bob” City, posting to Twitter/X across the time of his sentencing right this moment.
Sosa additionally was energetic in a very harmful group of completed prison SIM-swappers generally known as “Star Fraud.” Cyberscoop’s AJ Vicens reported in 2023 that people inside Star Fraud have been probably concerned within the high-profile Caesars Leisure and MGM Resorts extortion assaults that very same 12 months.
The Star Fraud SIM-swapping group gained the power to quickly transfer focused cell numbers to gadgets they managed by always phishing workers of the key cell suppliers. In February 2023, KrebsOnSecurity printed knowledge taken from the Telegram channels for Star Fraud and two different SIM-swapping teams exhibiting these crooks targeted on SIM-swapping T-Cellular prospects, and that they collectively claimed inside entry to T-Cellular on 100 separate events over a 7-month interval in 2022.
Reached by way of considered one of his King Bob accounts on Twitter/X, City referred to as the sentence unjust, and mentioned the decide in his case discounted his age as an element.
“The decide purposefully ignored my age as an element due to the actual fact one other Scattered Spider member hacked him personally in the course of the course of my case,” City mentioned in reply to questions, noting that he was sending the messages from a Florida county jail. “He ought to have been eliminated as a decide a lot earlier on. However staying in county jail is torture.”
A court docket transcript (PDF) from a standing listening to in February 2025 exhibits City was telling the reality concerning the hacking incident that occurred whereas he was in federal custody. It concerned an intrusion right into a Justice of the Peace decide’s e-mail account, the place a replica of City’s sealed indictment was stolen. The decide instructed attorneys for each side {that a} co-defendant within the California case was looking for out about Mr. City’s exercise within the Florida case.
“What it in the end became a was a giant fake pas,” Choose Harvey E. Schlesinger mentioned. “The Court docket’s password…enterprise is dealt with by an outdoor contractor. And someone referred to as the skin contractor representing Choose Toomey saying, ‘I would like a password change.’ And so they gave out the password change. That’s how whoever was making the telephone name received into the court docket.”
