Palm Coast man linked to ‘Scattered Spider’ cybercrime gang sentenced to 10 years for cryptocurrency theft

JACKSONVILLE, Fla. – A 20-year-old Palm Coast man linked to a massive cybercriminal gang was sentenced to 10 years in prison on Wednesday morning after pleading guilty to federal charges, including conspiracy and wire fraud.

Despite federal prosecutors requesting eight years and the defense requesting five years for Noah Urban, a federal judge decided to sentence Urban to 120 months in federal prison, with three years of supervised release. He also has to pay $13 million in restitution to victims.

In April, Urban pleaded guilty to charges in two separate federal cases: charges in Florida that were unsealed in January 2024, and charges in southern California that were announced in November of last year. In the Florida case, Urban pleaded guilty to conspiracy to commit wire fraud, and one count each of wire fraud and aggravated identity theft. In the California case, he pleaded guilty to one count of conspiracy to commit wire fraud.

In the Florida case, Urban was accused of stealing at least $800,000 in cryptocurrency from five different victims between August 2022 and March 2023. Prosecutors said Urban and others would steal victims’ personal information and arrange for the victims’ cell phone numbers to be swapped to phones that Urban and the other conspirators controlled. They would then use that to get control of the victims’ cryptocurrency accounts by resetting passwords and confirming via text message passwords. The tactic is known as “SIM swapping.”

As part of his plea agreement, Urban agreed to make restitution to all victims. The agreement listed amounts, victim by victim, for both the Florida and California cases. The amounts totaled more than $13 million across 59 individuals. Some of the restitution figures were listed for people who were not a victim of one of the offenses in Urban’s conviction, but the figures were agreed to as part of the plea deal. Typically, restitution is limited to actions that a defendant pleads guilty to, but Urban waived that in this agreement.

Urban, who according to the indictment was also known by aliases including “King Bob” (a reference to the “Minions” movie) and “Gustavo Fring” (a reference to a character from “Breaking Bad”), is believed to be a member of a group called “Scattered Spider.”

According to federal cybersecurity officials, the group targets large companies and their contracted IT help desks. Authorities warn that Scattered Spider members have:

• Posed as company IT and/or helpdesk staff using phone calls or SMS text messages to obtain login credentials from employees

• Posed as company IT and/or helpdesk staff to direct employees to run commercial remote access tools, giving them access

• Posed as IT staff to convince employees to share one-time passwords used for multi-factor authentication, a common security measure

• Monetized access to victim networks in numerous ways, including extortion enabled by ransomware and data theft.

Krebs on Security and 60 Minutes previously reported that Urban is a key figure in the crime ring, according to their sources.

In November 2024, prosecutors in Los Angeles announced that Urban was one of five people charged with running a scheme that targeted companies via phishing text messages. Prosecutors said the group would obtain employee login credentials, then steal non-public company data and information. Federal authorities also said the group would use the phishing messages to get access to virtual currency accounts, stealing millions of dollars in cryptocurrency.

According to the U.S. Attorney’s Office, the defendants in the California case conducted phishing attacks from at least September 2021 to April 2023. The messages often stated that the employees’ accounts were about to be deactivated, and provided links to phishing websites, which were disguised to look legitimate.

Prosecutors said the data that would later be stolen would include confidential work products, intellectual property, and personally identifiable information, such as account access credentials, names, email addresses, and telephone numbers. They say the group then used some of the stolen information in conjunction with other sources to access individuals’ cryptocurrency accounts and steal millions of dollars in virtual currency.

Urban’s plea agreement also includes a list of items that he agreed to forfeit, including cash, cryptocurrency, and physical items. Urban will forfeit assets of Dai, Ethereum, Monero, Bitcoin, and Ripple cryptocurrencies, all held in various cryptocurrency wallets. While the values of cryptocurrencies can vary, the Dai is currently worth approximately $1.3 million, and the largest portion of the Ethereum is currently worth approximately $1.3 million. Urban will also forfeit $27,702 in currency seized from a Palm Coast home, plus miscellaneous jewelry and six watches.

According to the plea agreement, in a May 2023 interview with investigators, Urban estimated he had personally made “several million dollars” between January 2021 and March 2023 through cryptocurrency theft, and that he had been involved with the theft of several million more overall. Urban told investigators that most of the funds he had personally made were lost on various online gambling websites, while he had a “few million” on his desktop computer. When his computer was seized in March 2023, it had approximately $2.89 million in cryptocurrency assets, which the plea agreement said were later valued at approximately $3.67 million in October 2024, due to fluctuating values.