Texas Hacker Pleads Guilty in Multi-Year Extortion Scheme Tied to Early Scattered Spider

A 24-year-old Texas resident, Ahmed Hossam Eldin Elbadawy, entered a guilty plea on federal charges Tuesday, admitting his role in a series of extortion attacks carried out by Early Scattered Spider, a sub‑group of the larger hacker collective known as The Com. Court documents show the offenses spanned at least from 2021 through 2023, targeting businesses and individuals with ransomware threats and demanding payment to prevent data exposure.

Early Scattered Spider has been linked to a pattern of “double‑extortion” tactics, where attackers not only encrypt victims' files but also threaten to release stolen data publicly. Law enforcement agencies have attributed dozens of incidents to the group, noting its use of sophisticated phishing campaigns and exploit kits to gain initial access to compromised networks.

The Department of Justice’s indictment outlines that Elbadawy participated in the planning and execution of the attacks, helping to coordinate ransom negotiations and facilitating the transfer of illicit proceeds. While the plea agreement does not disclose the exact financial penalties, it signals a willingness by prosecutors to secure a conviction without a lengthy trial.

Elbadawy’s admission comes amid a broader crackdown on cybercrime networks operating across borders. In recent months, U.S. authorities have announced several takedowns of ransomware infrastructure and arrested individuals linked to The Com and its affiliates. The coordinated effort reflects heightened focus on disrupting the financial pipelines that sustain these illicit operations.

Legal experts say the plea may encourage other members of Early Scattered Spider to cooperate with investigators, potentially exposing further details about the group’s hierarchy and methods. Such cooperation could aid in dismantling remaining nodes of the network and preventing future extortion campaigns.

The case underscores the growing challenge for organizations to defend against ransomware groups that blend technical expertise with aggressive extortion tactics. Cybersecurity professionals continue to advise robust backup strategies, employee training, and rapid incident response planning as essential defenses. As the investigation proceeds, authorities are expected to pursue additional charges against remaining participants, signaling that the fight against ransomware remains a priority for federal law enforcement.