Federal authorities have apprehended 19-year-old Remington Goy Ogletree for his alleged involvement in major cyber attacks targeting a U.S. financial institution and two telecommunications companies. Operating under the alias “remi,” Ogletree employed sophisticated phishing techniques to compromise corporate networks.
The Investigation
Between October 2023 and November 2023, approximately 149 employees at the targeted financial institution fell victim to Ogletree’s phishing campaign. The attacks involved impersonating IT support staff and creating fraudulent websites that mimicked legitimate company platforms. Employees were lured through deceptive messages about benefits updates, schedule changes, and HR inquiries.
Cryptocurrency Scheme
From October 2023 to May 2024, Ogletree leveraged compromised telecom systems to distribute over 8.6 million phishing text messages nationwide, targeting cryptocurrency holders. The campaign specifically impersonated legitimate crypto platforms Gemini and KuCoin.
Evidence and Arrest
FBI’s February search of Ogletree’s Texas residence uncovered substantial evidence on his iPhone, including phishing templates and cryptocurrency wallet screenshots containing thousands of dollars. During questioning, Ogletree acknowledged his connections to Scattered Spider and revealed the group’s strategy of targeting business process outsourcing companies due to their weaker security measures.
Scattered Spider Overview
The group, also known as 0ktapus, UNC3944, and Octo Tempest, consists of English-speaking hackers who coordinate through Telegram and Discord. Their tactics include social engineering, SIM swapping, and MFA bombing. The organization has been linked to high-profile attacks on MGM Resorts, Caesars, MailChimp, and other major companies, often collaborating with Russian ransomware groups.
Recent Law Enforcement Actions
Five additional suspects were recently charged in connection with Scattered Spider’s operations, facing potential 20-year prison sentences for wire fraud and identity theft. A separate arrest in the UK involved a 17-year-old suspect linked to the MGM Resorts ransomware attack.