Teleport

U.S. prosecutors have linked 19-year-old Peter Stokes, allegedly part of the Scattered Spider hacking group, to a May 2025 breach of a luxury jewelry retailer. The attackers used social engineering to manipulate the IT help desk into resetting passwords and bypassing multifactor authentication, then deployed tunneling tools like ngrok and Teleport to exfiltrate over 77 GB of data. Despite ransomware deployment being blocked, the attackers demanded $8 million in cryptocurrency. The FBI traced Stokes via a persistent Windows device ID tied to Microsoft account activity and correlated IP addresses from his online accounts.