Hook
More breakout videos from this creator.
A 19-year-old hacker just got tracked across three countries by an ID number sitting inside almost every Windows PC on the planet. So his name is Peter Stokes, a US Estonian citizen who's been linked to Scattered Spider. They're the hacking group behind MGM, Caesar's Palace breaches, and over $100 million in ransomware payments. One job tied to him was an attempt to squeeze $8 million in crypto out of a retailer, and they refused. They kicked the hackers out, still ended up eating two million in cleanup. He ran a VPN, and he rotated it through different countries, thinking that kept him anonymous. But a VPN only hides where your traffic comes from, to the identifier that Windows assigns to a specific installation called a GDID, a global device identifier. That much, that information comes straight from the FBI's own affidavit. Now, here's the bit that's still being pieced together. One independent researcher digging through the case says that the GDID isn't tied to your motherboard or your hard drive at all. He reckons it's a Microsoft account ID generated the moment that Windows registered with Microsoft. And that a full reinstall gives you a completely new one. That's one person's analysis so far, not something that Microsoft have confirmed. But that same researcher also claims that local accounts don't switch it off either. A fallback path generating an ID even with no Microsoft sign-in. Again, one source worth looking up anywhere else, but I can't pronounce it, so just do that search for GDID-reversal on Google. I'd give you the GitHub link, but I can't pronounce it, so just do that search. GDID-reversal. Your machine leaves a trail that your VPN doesn't hide.