Help Desk Roulette: Two Teens, A Script, And Your Weekend

Two teenagers walk into a help desk and ask for admin, not a joke, not even a shaggy dog story, just a queue ticket and a smile. The funny part, if your humor got hit by a bus, is the support team says sure, answer a few questions, and a week later an entire company wakes up locked out of its own life. That is not comedy, that is customer service used as a pry bar, patience on one end and a script on the other. And because the internet loves a franchise, prosecutors now say the kids were not freelancing, they were helping run pieces of Scattered Spider, the crew milking big brands with low tech tricks dressed up in rented tooling. “Have you tried turning it off and on again” hits different when the off switch runs a hospital.

Names to remember: Thalha Jubair, 19, London, and Owen Flowers, 18, Walsall. UK investigators link them to last year’s Transport for London breach. The US complaint pins well over a hundred intrusions on Jubair, with victims paying close to ninety million in bitcoin, a byte your CFO will feel. That is not lunch money, that is an annual security budget disappearing over a weekend, interest included and a migraine for dessert. Prosecutors also connect the crew to SSM Health Care and an attempted hit on Sutter Health, which means patient records and care schedules sat on the table while someone counted down in a chat window. Bienvenue to cybercrime in 2025, where a confident voice on the phone can unplug your clinic.

So what is actually happening. The same unglamorous loop that has been happening for years. Spear phish someone in a hurry, harvest the reused password, SIM swap the number, impersonate an employee, charm a help desk, jump into identity systems, then stroll to backups and billing like you own a badge. Social engineering is hospitality turned inward, like room service delivering your own master key, ridiculous until you remember how many breaches start with a friendly greeting. When you land, you threaten to publish customer data and the kind of internal chat logs that melt brands. First you hit basic dignity, people deserve control over their information, then you hit operations. Hospitals cannot pause care when records vanish. Transit cannot stop moving because schedules get scrambled. Payroll becomes a coin toss when authentication gets torched.

Why the heat now. Money leaves footprints, even when it hops through crypto. Investigators say they seized servers tied to Jubair and matched wallet flows to victim payments. That trail sits at the center of the US case, alongside computer fraud, wire fraud, and a laundering conspiracy. In the UK, both were arrested and remanded, Flowers was already on the board for the TfL case. If extradition moves, we will see how well the paperwork lines up with the chat logs. If it drags, the message to copycats is simple, keep your operational security tight and you can stretch your run. Either way, the playbook is public, and you can buy most of it as a service.

Here is the part budget meetings whisper past. If late teens can help move nine figures through a ransomware pipeline, the bar to entry sits lower than executives admit. The reasons are dull and fixable. Weak MFA. Reused passwords. Support teams measured on speed who genuinely want to help, then get gamed by confidence and a smooth voice, because who needs a second factor when vibes will do. Arrests slow a crew, they do not erase a revenue model. Someone else will read the indictment like homework, tweak the script, and call the same help desk on a Friday afternoon. Suivez l’argent, then ask who pays after. Customers and patients pay with exposed data and delayed care. Workers pay with cleanup sprints and missed weekends. The rest of us pay when premiums and prices creep up to cover the mess. Rules about fairness should not stop at the network edge. You should not get worse treatment because your clinic’s billing vendor clicked a link.

So why should you care, besides the part where your train, your paycheck, or your kid’s lab results might be inside the cone when this goes off. Because trust is the only reason we hand over data in the first place. Corporate secrecy around ransom payments shreds that trust, then asks for it back with a FAQ. Courts will sort who did what. The social contract tears long before the verdict if the people affected are kept in the dark. If you want fewer teenagers taking your weekend, treat identity like production, not paperwork. Strong MFA everywhere, phishing resistant keys for admins and support, kill SMS resets, record every high risk change and review them the way you review spend, give help desks scripts that default to caution, not speed. Build call backs to known numbers, require second person approvals for privilege changes, log every attempt like you log cash. Run drills that include legal and comms, publish timelines and controls after breaches so customers are not guessing. People click because their jobs are chaos, not because they are fools, keys are annoying to roll out, you still roll them out, and yes, someone will complain in the group chat.

Here is how you tell fixing from posturing. Fixing changes what front line staff do on a Tuesday at 4 p.m., with real keys, real logs, and real consequences when guardrails get skipped. Posturing ships a new slide template, buys a “threat intelligence” subscription no one reads, and promises training that gets rescheduled for quarter after quarter. One path reduces incidents and shortens recovery, the other buys nicer coffee for the incident war room.

It costs less than wiring bitcoin to strangers. And if the front door actually locks, fewer people try the handle, the few who do meet recording, alerts, and a team that knows what to do next. Start there, keep at it, and maybe your next headline is boring. Which, in this line of work, is the good kind of quiet.

--Doc (yeah I said it!)
find me anywhere under @DocAtCDI