Get tomorrow's brief in your inbox
Today: British cybercriminal Tyler Buchanan pleaded guilty to wire fraud and aggravated identity theft for participating in Scattered Spider's $8 million cryptocurrency theft scheme, facing up to 22 years in prison. The FCC granted Netgear a conditional exemption to the Trump administration's foreign router ban without disclosing the terms or security improvements required. Justice Clarence Thomas addressed Supreme Court collegiality changes and criticized what he characterized as judicial cowardice in civil rights cases.
British hacker tied to Scattered Spider campaign pleads guilty in $8M scheme
Tyler Robert Buchanan, 24, of Dundee, Scotland, pleaded guilty in U.S. federal court to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. Buchanan participated in the Scattered Spider cybercrime collective's campaign that stole at least $8 million in cryptocurrency through SMS phishing attacks targeting employees at companies including MGM Resorts, Coinbase, Twilio, Mailchimp, and LastPass. The group sent hundreds of deceptive text messages posing as legitimate company communications, directing victims to spoofed websites that harvested login credentials used to infiltrate company systems and access virtual currency accounts. Buchanan was arrested at Palma Airport in Spain in June 2024 and has been in U.S. federal custody since April 2025. Co-defendant Noah Michael Urban is serving a 10-year sentence after pleading guilty in April 2025, while three other co-conspirators (Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, and Joel Martin Evans) remain awaiting prosecution.
A Leak from the Interim Docket
Justice Clarence Thomas delivered remarks at the University of Texas at Austin addressing Supreme Court collegiality and judicial philosophy. Thomas stated that court dynamics have changed from the "World War II generation" that included Justice Sandra Day O'Connor, who "respected [a] tradition of a civil society, and who would listen to different points of views." Thomas criticized what he described as justices being "petrified by criticisms" or seduced by praise and retreating into "the tall grass of big words and eloquent phrases." He argued that the Court's 60-year delay in overturning Plessy v. Ferguson represented judicial "cowardice" rather than legal complexity, noting that Justice John Marshall Harlan's lone dissent made the correct answer "obvious." Thomas connected his critique to his views on progressivism, arguing it treats rights as government-granted rather than natural rights, contrasting this with principles he described as foundational to the Black community he grew up in under Jim Crow.
Netgear Gets Mysterious Exemption To Trump FCC 'Router Ban,' Refuses To Say How
Netgear became the first manufacturer to receive conditional FCC approval under the Trump administration's foreign router ban, but neither the FCC nor Netgear disclosed the terms required for the exemption. The FCC stated only that the Pentagon made "a specific determination" that Netgear devices "do not pose risks to U.S. national security." Netgear's public statement claimed the approval means its products meet "rigorous standards" but provided no details about security improvements, manufacturing changes, or other conditions. The original FCC policy included rhetoric requiring foreign manufacturers to provide "a detailed, time-bound plan to establish or expand manufacturing in the United States," but Netgear's public statements and investor disclosures contain no indication the company committed to U.S. manufacturing expansion. The conditional waiver system requires router manufacturers to obtain FCC approval to continue operating in the U.S. market, effectively functioning as a case-by-case licensing regime.
Review SMS phishing defenses: The Scattered Spider prosecution demonstrates continuing effectiveness of SMS-based credential theft. Audit employee training on text message verification, implement MFA for all privileged accounts, and establish out-of-band verification procedures for authentication requests received via SMS.
Document router security decisions: The FCC's opaque conditional waiver process for Netgear creates uncertainty about future network equipment compliance requirements. Maintain vendor security assessment records and procurement justifications for all network infrastructure purchases.
Monitor cryptocurrency custody controls: The $8 million Scattered Spider theft highlights vulnerabilities in virtual currency account access. If your organization holds cryptocurrency, review seed phrase storage, multi-signature wallet configurations, and separation of duties for transaction approval.
Assess third-party impersonation risks: Scattered Spider's success in posing as legitimate service providers (targeting companies like Twilio and Mailchimp) demonstrates social engineering sophistication. Test employee ability to distinguish authentic vendor communications from spoofed messages, particularly for services with privileged system access.