Ahmed Hossam Eldin Elbadawy pleaded guilty exactly one year ago to wire fraud conspiracy and aggravated identity theft, court records show — a fact that only surfaced publicly this week after prosecutors filed an order seeking the proceeds of his crimes.
Charges, plea timing, and the immediate legal posture
Federal court filings reveal that Elbadawy, a 24-year-old from Texas, entered a guilty plea to federal charges tied to an extortion and theft campaign carried out with others in the Scattered Spider subset of The Com. Although the plea was entered a year ago, prosecutors did not publicize it until they filed an order of forfeiture this week to seize assets they say were obtained through the criminal scheme. The terms of Elbadawy’s plea agreement have not been released.
Co‑conspirators and the 2024 indictment
Prosecutors linked Elbadawy to a group that included Noah Michael Urban, a Florida man who was sentenced to 10 years in prison last year, and Tyler Robert Buchanan, a Scottish man who pleaded guilty in April and currently awaits sentencing. Federal authorities filed charges against five individuals with ties to the Scattered Spider cybercrime outfit in 2024; the named defendants include Elbadawy, Urban, Buchanan, Evans Onyeaka Osiebo and Joel Martin Evans. An indictment filed in late 2024 connects the defendants to a string of extortion attacks and related cybercrimes.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale of victims, thefts, and sectors targeted
Prosecutors say Elbadawy and his co‑conspirators used social engineering to obtain credentials and exfiltrate sensitive company data, then identified high‑net‑worth employees with virtual currency accounts. The indictment links them to at least 12 victim companies — including three businesses located in Southern California, where Elbadawy awaits sentencing — and authorities detailed 29 victims who were compromised by the crew. The conspirators stole virtual currency from wallets controlled by many victims; the indictment cites high‑value thefts of nearly $6.35 million in September 2021, $571,000 in June 2022 and nearly $1.7 million in December 2022. Victims included large businesses in the entertainment, telecom, technology, business process outsourcing, IT, cloud and virtual currency sectors.
Prosecutors’ forfeiture request: cryptocurrency, cash, and luxury items
In the forfeiture filing made public this week, prosecutors asked the court to seize a range of property and assets they associate with Elbadawy’s criminal activity. The list includes Bitcoin valued at more than $14.19 million and Ethereum valued at more than $3.4 million, along with nearly $63,000 in cash. Officials also sought forfeiture of a lifted golf cart, three luxury vehicles, a painting of Muhammad Ali, luxury watches, gold jewelry, a vast collection of designer bags and 150 pairs of shoes. Those items are identified in court records as proceeds or instruments of the alleged scheme.
Scattered Spider, The Com, and the criminal behaviors described in the indictment
The group at the center of the indictment is described as Scattered Spider, an aggressive subset of a broader online collective prosecutors call The Com. According to the filings, The Com has grown to thousands of members typically between 11 and 25 years old and has splintered into three primary subsets the FBI describes as Hacker Com, In Real Life Com and Extortion Com. Prosecutors say members of these interconnected networks have engaged in swatting, extortion and sextortion of minors, production and distribution of child sexual abuse material, violent crime and other cybercrimes.
What this means for affected enterprises, prosecutors, and victims
- For enterprises in entertainment, telecom, technology, BPO, IT, cloud and virtual‑currency sectors: the indictment underscores how social engineering and targeted credential theft can yield large cryptocurrency losses tied to a relatively small number of high‑value accounts.
- For prosecutors and asset‑recovery teams: the forfeiture filing demonstrates an effort to convert cryptocurrency and tangible luxury purchases into recoverable assets, with requests that name specific holdings — Bitcoin and Ethereum balances, cash and high‑end consumer items.
- For victims and the public: the record supplied to the court identifies dozens of compromised victims and substantial theft amounts, signalling prolonged criminal campaigns rather than isolated incidents.
The publicly released indictment and the recent forfeiture motion together map the arc of one criminal thread inside a larger, fracturing online network: guilty pleas already entered, lengthy sentences already imposed on at least one co‑conspirator, and prosecutors now pressing to seize cryptocurrency and luxury assets. The plea agreement’s terms remain sealed, and Elbadawy’s sentencing location and timing are now linked in court filings to Southern California; beyond that, the filings leave open questions about other members’ roles and the full extent of proceeds recovered. Read the indictment and filings here: https://cyberscoop.com/scattered-spider-member-guilty-ahmed-elbadawy/
