A young Florida-based man has been sentenced to 10 years in prison after pleading guilty to federal charges linked to cybercrime, including conspiracy and wire fraud.
Noah Michael Urban, 20, was arrested in January 2024 and charged by a Florida court with five counts of aggravated identity theft for running a SIM swapping scheme and stealing at least $800,000 in cryptocurrency from five different people between August 2022 and March 2023.
In November 2024, Urban was also charged by a California court, alongside four other individuals, with one count of conspiracy to commit wire fraud, one count of conspiracy, and one count of aggravated identity theft.
The co-conspirators were accused of tricking employees across the US with phishing texts to steal login credentials. These credentials were then used to break into company systems, steal sensitive data and drain millions of dollars in cryptocurrency. These activities ran from at least September 2021 to April 2023.
Urban pleaded guilty to conspiracy to commit wire fraud, and one count each of wire fraud and aggravated identity theft in the California case.
In the Florida case he pleaded guilty to one count of conspiracy to commit wire fraud.
Both cases brought against him resulted in the 10-year prison sentence, first reported by Florida-based local news outlet News 4 Jax on August 20.
Under his plea deal, Urban committed to repaying all victims, even beyond the charges he admitted to. The agreement broke down the amounts owed to 59 individuals in both the Florida and California cases, totaling over $13m.
While restitution usually applies only to crimes tied to a defendant’s conviction, Urban’s deal included payments to some victims unconnected to his admitted offenses, a concession he explicitly agreed to waive.
Urban’s Ties to Scattered Spider
Urban was known by aliases like ‘King Bob,’ ‘Anthony Ramirez,’‘Elijah,’ ‘Gustavo Fring’ and ‘Sosa’ in the underground online world.
According to independent cybersecurity reporter Brian Krebs, Urban was a core member of a hacking group behind the July 2022 breach at communication tool provider Twilio.
The attack was attributed to a group tracked by Group-IB as ‘0ktapus’, also known as Scattered Spider.
The MITRE ATT&CK website and the Fraunhofer-run Malpedia repository also associate 0ktapus and Scattered Spider as the same group.
Scattered Spider has been involved with breaches at more than 130 organizations, including LastPass, DoorDash, Mailchimp, Plex, Caesars Entertainment, MGM World, Marks & Spencer and The Co-op.
For years, Urban, under his ‘King Bob’ and ‘Sosa’ aliases, was a prominent figure in ‘The Com,’ an online cybercrime hub where hackers flaunt social-engineering-driven hacks and linked to Scattered Spider.
Krebs reported that ‘King Bob’ repeatedly boasted about stealing unreleased rap tracks, likely via SIM-swapping, then selling or leaking them on underground forums.
Urban is the first member of Scattered Spider to receive a prison sentence.