JACKSONVILLE, Fla. – A 20-year-old Palm Coast man linked to a massive cybercriminal gang pleaded guilty in a Jacksonville federal courtroom Friday morning to charges including conspiracy and wire fraud.
Noah Urban faced charges in two separate federal cases: charges in Florida that were unsealed in January 2024, and charges in southern California that were announced in November of last year. In the Florida case, Urban pleaded guilty to conspiracy to commit wire fraud, and one count each of wire fraud and aggravated identity theft. In the California case, he pleaded guilty to one count of conspiracy to commit wire fraud.
In the Florida case, Urban was accused of stealing at least $800,000 in cryptocurrency from five different victims between August 2022 and March 2023. Prosecutors said Urban and others would steal victims’ personal information and arrange for the victims’ cell phone numbers to be swapped to phones that Urban and the other conspirators controlled. They would then use that to get control of the victims’ cryptocurrency accounts by resetting passwords and confirming via text message passwords. The tactic is known as “SIM swapping.”
As part of his plea agreement, Urban agreed to make restitution to all victims. Typically, restitution is limited to actions that a defendant pleads guilty to, but Urban waived that in this agreement. A restitution amount was not made clear during Friday’s hearing.
Urban, who according to the indictment was also known by aliases including “King Bob” (a reference to the “Minions” movie) and “Gustavo Fring” (a reference to a character from “Breaking Bad”), is believed to be a member of a group called “Scattered Spider.”
According to federal cybersecurity officials, the group targets large companies and their contracted IT help desks. Authorities warn that Scattered Spider members have:
-
Posed as company IT and/or helpdesk staff using phone calls or SMS text messages to obtain login credentials from employees
-
Posed as company IT and/or helpdesk staff to direct employees to run commercial remote access tools, giving them access
-
Posed as IT staff to convince employees to share one-time passwords used for multi-factor authentication, a common security measure
-
Monetized access to victim networks in numerous ways including extortion enabled by ransomware and data theft.
Krebs on Security and 60 Minutes reported previously reported that Urban is a key figure in the crime ring, according to their sources.
In November 2024, prosecutors in Los Angeles announced that Urban was one of five people charged with running a scheme that targeted companies via phishing text messages. Prosecutors said the group would obtain employee login credentials, then steal non-public company data and information. Federal authorities also said the group would use the phishing messages to get access to virtual currency accounts, stealing millions of dollars in cryptocurrency.
According to the U.S. Attorney’s Office, the defendants in the California case conducted phishing attacks from at least September 2021 to April 2023. The messages often stated that the employees’ accounts were about to be deactivated, and provided links to phishing websites, which were disguised to look legitimate.
Prosecutors said the data that would later be stolen would include confidential work products, intellectual property, and personally identifiable information, such as account access credentials, names, email addresses, and telephone numbers. They say the group then used some of the stolen information in conjunction with other sources to access individuals’ cryptocurrency accounts and steal millions of dollars in virtual currency.
A sentencing date has not yet been set, but it’s expected to take place in about 75 days. Prior to the sentencing, the court’s probation office will prepare a pre-sentencing report, which will include a calculation of the recommended sentencing range under federal sentencing guidelines.
Copyright 2025 by WJXT News4JAX – All rights reserved.
