Overview
Ahmed Hossam Eldin Elbadawy, one of the earliest identified members of the Scattered Spider cybercrime group, has pleaded guilty to wire fraud conspiracy and aggravated identity theft. The plea itself was entered quietly in October 2025, but it only became public this month after federal prosecutors filed a preliminary order of forfeiture seeking roughly $17.6 million in virtual currency, luxury vehicles, and jewelry tied to the case.
Elbadawy, who goes by the alias "AD," was one of five defendants named in a November 2024 federal indictment out of the Central District of California that first mapped the Scattered Spider network for prosecutors.
Who Is Ahmed Elbadawy
Elbadawy, now 24, is from College Station, Texas. He was 23 years old when he was first charged in November 2024, alongside four co-defendants: Noah Michael Urban ("Sosa"/"Elijah") of Palm Coast, Florida; Tyler Robert Buchanan of Dundee, Scotland; Evans Onyeaka Osiebo of Dallas, Texas; and Joel Martin Evans ("joeleoli") of Jacksonville, North Carolina.
Prosecutors describe Scattered Spider as a "loosely organized, financially motivated" hacking crew that relied on social engineering — including SIM-swapping and phishing text messages impersonating IT help desks — to trick employees at target organizations into handing over credentials. According to the indictment, the group frequently went after telecommunications, IT, and business-process-outsourcing suppliers that contracted with larger companies, using that access as a stepping stone into bigger corporate environments. Then-U.S. Attorney Martin Estrada said at the time that the group "perpetrated a sophisticated scheme to steal intellectual property and proprietary information worth tens of millions of dollars."
Court filings tie Elbadawy and his co-conspirators to at least 12 victim companies, three of them in Southern California, spanning the entertainment, telecom, technology, cloud, and virtual-currency sectors. Prosecutors have detailed 29 total victims compromised across the broader case, with the group draining employee and corporate cryptocurrency wallets — including thefts of roughly $6.35 million in September 2021, $571,000 in June 2022, and $1.7 million in December 2022. Our research did not turn up any confirmed link between Elbadawy specifically and the MGM Resorts or Caesars Entertainment breaches sometimes associated with the broader Scattered Spider ecosystem; those intrusions have not been attributed to him in court filings reviewed for this story.
The Charges and Plea
Elbadawy faced three counts in a May 2025 superseding indictment: conspiracy to commit wire fraud, conspiracy, and aggravated identity theft. In October 2025, he pleaded guilty to two of those counts — wire fraud conspiracy and aggravated identity theft — under a plea agreement whose full terms have not been made public.
Wire fraud conspiracy carries a maximum sentence of 20 years in federal prison (up to 30 years if a financial institution was affected), while aggravated identity theft carries a mandatory two-year sentence that must run consecutively to any other prison term. A sentencing date has not yet been set.
The guilty plea stayed out of public view for nearly a year, surfacing only after prosecutors asked the court this week for a preliminary order of forfeiture covering the proceeds of Elbadawy's crimes: about 175 Bitcoin (roughly $13.3 million), 1,306 Ethereum (roughly $3.2 million), $62,720 in cash, and a collection of luxury goods that included a BMW i8, a Chevrolet Corvette, a Mercedes-Benz G63 AMG, an ATV, watches, jewelry, more than 150 pairs of designer shoes, designer handbags, and a Muhammad Ali painting.
Scattered Spider Context
Scattered Spider (also tracked under aliases such as UNC3944, Octo Tempest, and 0ktapus) has been one of the most disruptive social-engineering-driven threat groups of the past several years. Rather than relying primarily on malware or exploited vulnerabilities, the group's playbook centers on impersonating employees to IT help desks, SIM-swapping phone numbers to intercept multi-factor authentication codes, and pivoting through outsourced IT and telecom providers to reach larger targets. The group has also been linked to deploying ransomware, including strains associated with the ALPHV/BlackCat affiliate ecosystem, once inside victim networks.
Of Elbadawy's co-defendants, Noah Urban was sentenced last year to 10 years in federal prison and ordered to pay $13 million in restitution. Tyler Buchanan pleaded guilty in April 2026 to conspiracy to commit wire fraud and aggravated identity theft and faces up to 22 years at his own pending sentencing. Evans Onyeaka Osiebo and Joel Martin Evans still face charges in the case, according to the Justice Department.
What's Next
With Elbadawy's plea now public, attention turns to his sentencing date and to whether the court grants the government's forfeiture request in full. His case, alongside Buchanan's, leaves Osiebo and Evans as the remaining defendants from the original five-person indictment still awaiting resolution. Given the scale of assets already recovered and the mandatory consecutive sentence tied to the identity-theft count, Elbadawy is expected to face a substantial prison term even before accounting for whatever additional exposure his still-sealed plea agreement carries.