A Windows device identifier that survives OS updates but changes on reinstall — that’s what led the FBI to Peter Stokes.
The 19-year-old dual U.S.-Estonian citizen, known online as “Bouquet,” is charged with conspiracy, computer intrusion, and fraud tied to the Scattered Spider hacking group. A federal complaint unsealed in Chicago lays out the trail.
Here’s the story the complaint tells.
Between May 12 and 15, 2025, attackers called a luxury jewelry retailer’s IT help desk from Google Voice numbers. They pretended to be locked-out employees. The help desk reset passwords and swapped the mobile devices tied to MFA. Within hours, the attackers controlled three accounts — two belonging to IT admins. They installed ngrok and Teleport for tunneling, exfiltrated at least 77 GB to Amazon cloud storage, and demanded $8 million in crypto. The company didn’t pay, but the breach still cost about $2 million in cleanup.
The entry point wasn’t a software bug. It was a phone call. Fix: verify identity before any reset. Call back a number on file. Require manager sign-off. FIDO2 keys won’t help if the help desk hands over access on a voice call.
Microsoft told the FBI the device that opened the ngrok account carried a Global Device Identifier — g:6755467234350028. That ID tied to the same machine that visited the retailer’s site through the same proxy. It also appeared on the same IPs, at the same times, as Snapchat, Apple, and Facebook accounts the feds say belong to Stokes. Tallinn in June 2024. New York in November. Thailand in February 2025. State Department travel records matched.
The complaint shows someone who hid the attack under VPNs and aliases — but not himself. His Snapchat flaunted cash, watches, and a chain reading “HACK THE PLANET.” He even posted photos of an Estonian police station, taunting that the feds had no clue what they let get away.
Finnish police stopped Stokes at Helsinki airport trying to board a flight to Japan. They seized two 2-terabyte hard drives. Those drives could matter more than the conviction — in a network this diffuse, they might hold the tools and contacts that reach the next member.
Group-IB argues Scattered Spider isn’t really one group. It’s a loose collective of small, independent cells tied by shared tricks, not a shared boss. Arresting some of them “will not stop the threat itself.”
