Counterintelligence & Tradecraft — 2026-04-22

Scattered Spider member Tyler Buchanan pleads guilty to $8M SMS-phishing conspiracy spanning Twilio, LastPass, DoorDash, Mailchimp

Tyler Robert Buchanan, 24, a Scottish national known in cybercrime circles as "Tylerb," pleaded guilty on 21 April to wire-fraud conspiracy and aggravated identity theft for SMS-phishing attacks in 2022 that compromised Twilio, LastPass, DoorDash, Mailchimp, and at least a dozen other technology companies. The Justice Department said Buchanan admitted stealing at least $8 million in cryptocurrency through SIM-swap attacks that leveraged stolen enterprise credentials; FBI investigators tied him to the campaign through a username reused across phishing-domain registrations and a U.K. residential IP address lease confirmed by Scottish police. Extradited from Spain in 2025, Buchanan faces a 22-year statutory maximum at 21 August sentencing. He is the second known Scattered Spider member to plead guilty, after Noah Urban of Palm Coast, Florida.

Analysis
The plea consolidates the federal characterization of Scattered Spider as a social-engineering service layer feeding both criminal and, through The Com's fluid membership, indirectly state-aligned actors, per Krebs on Security, whose direct reporting relationships into the FBI case team make this the authoritative public record on Scattered Spider attribution. Cooperating-witness disclosures at the upcoming sentencing hearings will very likely, within the next 3-4 months, extend attribution to the same help-desk-impersonation pipeline behind the more recent Marks & Spencer and TfL breaches; personal-device SMS authentication remains the exploitable seam for IC-cleared contractor workforces, and the DOJ's cooperation-heavy playbook will likely continue generating attribution of adjacent retail-and-transportation incidents. Buchanan may instead negotiate a cooperation agreement rather than serve the full 22-year exposure, surfacing SIM-swap vendor relationships and credential-resale networks not yet in the public record, a move that would substantially reshape defender priorities.

1 sources

Scattered Spider Member Tylerb Pleads Guilty - Krebs on Security