Google Voice to the help desk
The callers posed as Company F employees and requested a password and MFA device reset.
The VPN hid the IP. Windows remembered the machine.
In May 2025, a group tied to Scattered Spider walked into a US company's network through a phone call to the help desk. A year later, a federal complaint shows how a Windows identifier connected the ngrok account used in the attack to Google accounts, social media logs and travel records, all the way to a suspect: Peter Stokes.
The complaint is an allegation and Stokes is presumed innocent; this page reads the document as public intelligence material.
3
accounts compromised after the help desk calls, two of them IT admin
77+ GB
of data exfiltrated, mainly through Teleport.sh and Amazon S3
$8M
demanded as ransom after the attackers were evicted from the network
19:21 UTC
the minute the ngrok account was created and the GDID device opened the signup page
Attack path / attribution path
Company F, May 2025
entering the network
The ID persists through system updates and changes on reinstall, per the Microsoft description cited by the FBI.
operator continuity
The calls requested a password and MFA device reset. Within two to three hours, the attackers controlled three Company F accounts.
the operational chain
The way in was a phone call and an approved reset.
The complaint describes an intrusion built from mundane steps: a call, a reset, a privileged account, a tunnel, exfiltration, financial pressure. The sophisticated part starts only after identity verification at the help desk gives way.
Three accounts compromised
Within roughly two to three hours, three accounts were under attacker control, two of them IT admin.
Elevated privileges
The standard accounts opened the way to high-privilege accounts used on virtualization and cloud platforms.
ngrok on the server
An ngrok agent opened tunnels into Company F infrastructure, its token tied to a freshly created ngrok account.
Teleport and Amazon S3
Persistence and exfiltration continued through Teleport.sh and S3, in parallel with the security team's attempts to shut off access.
Ransom email
After eviction, the attackers sent the message "IMPORTANT: WE STOLE THE DATA" and demanded $8 million.
the continuity evidence
The GDID tied the ngrok account to one specific Windows install.
In the Microsoft description cited by the FBI, the identifier belongs to the Windows installation on a device or virtual machine. That is the difference from an IP: a proxy can be rented, but the installation using the proxy resurfaces in other logs.
May 12, 2025, 19:21 UTC
ngrok dates the account used in the intrusion to that moment. Microsoft places the GDID device on dashboard.ngrok.com/signup in the same minute.
the same technical route
The ngrok account was created from 68.235.46.168, a VPN proxy. The GDID device used the same Tzulo server in May 2025.
22:47 UTC
Just over three hours after the ngrok account was created, the same GDID shows up tied to a visit to the Company F website, through the .168 proxy.
the phone becomes an account
A Google account tied to one of the phishing call numbers also appears in the ngrok subscriber data.
same identity, different tool
The same Google account appears in the subscriber data for the Teleport.sh accounts used in the exfiltration.
overlapping logs
The GDID shares IPs with Snapchat, Facebook and Apple accounts attributed to Stokes and matches routes through Tallinn, New York and Thailand.
how the identifier travels
From the identity service to telemetry.
A reconstruction published on GitHub follows the identifier through the Windows identity service, local storage, the Connected Devices Platform and the Device Directory Service. Microsoft documentation separately confirms the GlobalDeviceId telemetry surface.
- wlidsvc Windows identity service
- Device PUID service-assigned value
- registry value persisted locally
- CDP / DDS registration in the device graph
- UCDOStatus official telemetry surface
- COURT / RECORD
- The value published in the complaint is g: followed by a decimal number that fits in 64 bits. That describes the public exhibit, not the format of every GDID.
- ASSESSED / INFERENCE
- The fact that a reinstall produces a new GDID is incompatible with a simple hash of fixed hardware serials.
- OBSERVED + STATIC
- The reverse engineering links Device PUID to wlidsvc, then to cdp.dll and DDS. It is treated as an independent technical explanation, not a Microsoft statement.
Reconstruction limit: the repository also describes an anonymous CDP path. MSA is not treated here as a prerequisite.
attribution residue
Location is easy to hide. Continuity is hard to hide.
The strength of the investigation comes from overlapping four independent registers: device, accounts, tools and lifestyle. Each register can be contested alone; together they form the continuity the complaint attributes to a single person.
Device residue
The GDID keeps the Windows install visible in Microsoft logs even when traffic runs through a proxy.
the machine
Account residue
Google, ngrok and Teleport tie phone numbers, emails and subscriber data to the tools used in the intrusion.
the operating identity
Tool residue
ngrok, Teleport and S3 leave connection events, tokens and transfer patterns.
the infrastructure
Lifestyle residue
Social accounts and travel records layer time and place over the IPs already present in the logs.
the physical presencethe defender's reading
Defense starts at the help desk, before any conversation about malware.
The attack began with a procedure that worked exactly as written. The case is useful defensively because every link in the chain has an organizational countermeasure, available before any investment in detection.
Callback on the number already on file
Password or MFA resets for privileged accounts go back to a previously verified identity, never to the number on the current call.
JIT admin with separate approval
A compromised standard account keeps no direct path to high-privilege access: manager approval, step-up verification, an access journal.
ngrok, Teleport, S3 in telemetry
Their installation on sensitive servers, new tunnel events and unusual egress toward public storage get correlated immediately, at incident priority.
SaaS logs get kept
When the IP is noisy, correlation comes from provider logs. Retention is what lets an internal investigation move past "it was a proxy".
Containment plus accounting
Company F avoided encryption, but the data still left. The playbook measures the loss, alongside shutting off access.
Telemetry requires governance
The same granularity that helps an investigation carries abuse risk. Access, retention and auditing of persistent identifiers get treated as policy decisions, with clear accountability.
sources
The document, the reconstruction, the status.
Federal complaint
United States v. Peter Stokes, superseding complaint, signed April 16, 2026, unsealed in July 2026. The page's technical chain follows ¶20–22 (the Company F intrusion), ¶23–27 (ngrok, proxy, GDID), ¶28–30 (the account, IP and travel correlations) and ¶31 (probable cause).
Microsoft Learn
UCDOStatus, updated May 29, 2026. It documents GlobalDeviceId as an internal identifier and lists it alongside last telemetry time, ISP and an approximate IP-derived location. It does not document how the identifier is generated.
Reverse engineering
SmtimesIWndr, Full writeup of the Windows GDID, July 6, 2026. A reconstruction on Windows 11 build 26200 using public symbols, ETW and registry observations. It supports the architecture explanation and labels its claims; it is not Microsoft documentation.
The Hacker News
Swati Khandelwal, "Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker", July 7, 2026.
Status
The case is at the charging stage: the complaint asserts probable cause, and guilt remains for a court to decide. The victim company appears in the document only as "Company F", and this page keeps that anonymization and omits operational detail that would help repeat the intrusion.
"Scattered Spider", "Octo Tempest", "UNC3944" and "0ktapus" appear in the complaint as names for the same activity cluster. "Attribution residue" names the continuity traces between device, accounts and logs. The labels COURT, OBSERVED, STATIC and ASSESSED separate the court record, observation, binary analysis and technical inference.