{"id":16530,"date":"2026-07-30T08:31:36","date_gmt":"2026-07-30T08:31:36","guid":{"rendered":"https:\/\/newestek.com\/?p=16530"},"modified":"2026-07-30T08:31:36","modified_gmt":"2026-07-30T08:31:36","slug":"a-scattered-spider-member-was-indicted-microsofts-gdid-went-to-trial","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16530","title":{"rendered":"A Scattered Spider member was indicted. Microsoft\u2019s GDID went to trial."},"content":{"rendered":"<div>\n<div id=\"remove_no_follow\">\n<div class=\"grid grid--cols-10@md grid--cols-8@lg article-column\">\n<div class=\"col-12 col-10@md col-6@lg col-start-3@lg\">\n<div class=\"article-column__content\">\n<section class=\"wp-block-bigbite-multi-title\">\n<div class=\"container\"><\/div>\n<\/section>\n<p class=\"wp-block-paragraph\">A recently released <a href=\"https:\/\/www.justice.gov\/usao-ndil\/pr\/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and\">criminal complaint against Peter Stokes<\/a>, an alleged member of the <a href=\"https:\/\/www.csoonline.com\/article\/4020567\/anatomy-of-a-scattered-spider-attack-a-growing-ransomware-threat-evolves.html\">Scattered Spider cybercrime group<\/a>, reveals previously unpublicized details about <a href=\"https:\/\/www.csoonline.com\/article\/559063\/how-windows-10-data-collection-trades-privacy-for-security.html\">Windows telemetry<\/a>.<\/p>\n<p class=\"wp-block-paragraph\">Microsoft has never exactly had a reputation for being privacy-focused, however the complaint reveals the important part played by Microsoft\u2019s Global Device Identifier (GDID), a persistent identifier tied to a Windows installation, in the case.<\/p>\n<p class=\"wp-block-paragraph\">GDID enabled investigators to correlate the suspect\u2019s Windows installation with ngrok signup activity and other telemetry. But security experts and lawyers tell CSO that GDID was only one piece of evidence in a broader correlation chain involving provider records, IP history, and other account logs that helped investigators identify Stokes as a suspect in a May 2025 attack on a luxury jewelry retailer.<\/p>\n<p class=\"wp-block-paragraph\">\u201cMicrosoft wasn\u2019t watching ngrok; it was watching the device, and investigators connected the dots,\u201d says Dray Agha, senior manager of security operations at managed detection and response firm Huntress.<\/p>\n<p class=\"wp-block-paragraph\">Still, the indictment stirred many questions from the broader technology community and privacy advocates regarding Microsoft\u2019s data collection practices around the little-known and scantly documented GDID.<\/p>\n<h2 class=\"wp-block-heading\" id=\"gdid-link-in-a-chain-of-evidence-or-smoking-gun\">GDID: Link in a chain of evidence or smoking gun?<\/h2>\n<p class=\"wp-block-paragraph\">GDID is a unique identifier that is automatically assigned and linked to a single Windows installation and remains consistent across Windows updates, although reinstalling Windows creates a new GDID. The ID is sent to Microsoft servers as part of telemetry capture for various Microsoft-related services and apps, some of which are bundled within Windows.<\/p>\n<p class=\"wp-block-paragraph\">According to the indictment, Microsoft records showed that the Windows device linked to Stokes\u2019 GDID visited a signup page for ngrok, a service used to securely expose local development servers to the internet. The records also reportedly showed that the Windows device associated with Stokes\u2019 GDID accessed websites through Tzulo proxy servers and later visited the victim company\u2019s website.<\/p>\n<p class=\"wp-block-paragraph\">The details of this activity reportedly collected by Microsoft and linked to Stokes\u2019 Windows device raised significant concerns among Windows users and the data privacy community alike.<\/p>\n<p class=\"wp-block-paragraph\">But as Benson Varghese, a board-certified criminal lawyer at US law firm Varghese Summersett, notes, the criminal complaint is a probable-cause document rather than a technical audit trail.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe phrase \u2018Microsoft records\u2019 may compress several different data sources into one sentence,\u201d Varghese tells CSO. \u201cIt does not necessarily mean Windows itself was logging every website visited in every browser, but it does suggest investigators obtained records tied to a persistent device identifier and then linked that identifier to activity involving third-party services.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Everett Lupton, a criminal attorney at US law firm Slaughter &amp; Lupton, also notes the technically ambiguous nature of the indictment.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe criminal complaint, however, does not provide enough technical detail to explain exactly how these records were generated or which Microsoft product collected them,\u201d Lupton tells CSO. \u201cIt is unclear whether Microsoft captured the full web addresses through Edge, Microsoft Defender SmartScreen, another security service, or another Microsoft product.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Lupton continues: \u201cIt is also possible that Microsoft did not hold a complete browsing history. Investigators could instead have correlated Microsoft device, timestamp, and IP records with separate records obtained from ngrok and Tzulo. This is not clear from the wording of the complaint.\u201d<\/p>\n<p class=\"wp-block-paragraph\">If the records came from Edge, SmartScreen, Defender, Microsoft account services, crash reporting, or another Microsoft component, the privacy and legal implications raised around GDID change from persistent retention of activity associated with an individual user to those that arise from correlating disparate sources of information.<\/p>\n<p class=\"wp-block-paragraph\">\u201cIf Microsoft merely had timestamps, IP addresses, device identifiers, or security telemetry that prosecutors later correlated with ngrok and Tzulo logs, that is different from Microsoft retaining browsing history,\u201d according to Varghese. \u201cThe complaint language is too thin to answer that confidently.\u201d<\/p>\n<p class=\"wp-block-paragraph\">As far as Huntress\u2019 Agha can tell, investigators \u201clikely correlated subpoenaed access logs from ngrok and Tzulo with standard Windows telemetry.\u201d<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe indictment makes it sound like one neat database, but in reality, investigators stitched disparate data sources together after the fact,\u201d he says.<\/p>\n<h2 class=\"wp-block-heading\" id=\"privacy-has-its-limits\">Privacy has its limits<\/h2>\n<p class=\"wp-block-paragraph\">The case highlights the privacy limitations of privacy-enhancing technologies such as <a href=\"https:\/\/www.csoonline.com\/article\/558743\/5-things-you-need-to-know-about-virtual-private-networks.html\">virtual private networks<\/a> (VPNs) and <a href=\"https:\/\/www.csoonline.com\/article\/565798\/what-is-the-tor-browser-how-it-works-and-how-it-can-help-you-protect-your-identity-online.html\">Tor<\/a>, which serve to hide the source and destination of internet traffic through the use of proxies and relays.<\/p>\n<p class=\"wp-block-paragraph\">\u201cTools like Tor and VPNs mask IP addresses, but persistent identifiers like the GDID are baked into the OS itself,\u201d Agha explains. \u201cIf a device routinely \u2018phones home\u2019 to Microsoft for updates or syncing while connected to a proxy, it broadcasts its unique ID from that masked IP.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Agha adds: \u201cThis effectively tags the proxy with a known device, stripping away the anonymity the privacy tool was supposed to provide; operational security often stops at the network layer.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Varghese adds: \u201cThis case shows why endpoint telemetry is often more valuable to investigators than network logs. If data was collected before anyone knew the suspect\u2019s name, privacy tools used later may not matter much.\u201d<\/p>\n<p class=\"wp-block-paragraph\">Catching a Scattered Spider suspect is a clear win for law enforcement but it reveals that every standard Windows user is generating a similarly durable, searchable record long before anyone is a suspect.<\/p>\n<p class=\"wp-block-paragraph\">\u201cThe fact that a persistent device ID can be queried by law enforcement to unmask users raises legitimate, under-discussed questions about Microsoft\u2019s data retention periods, the lack of a clear opt-out for the GDID, and the broader privacy implications for everyday users,\u201d Agha concludes.<\/p>\n<p class=\"wp-block-paragraph\">Technology companies may be required to provide account and device records when served with valid subpoenas, warrants, or court orders. \u201cHowever, users may still be surprised that a single persistent identifier can help link activity across different IP addresses and services,\u201d Lupton concludes.<\/p>\n<p class=\"wp-block-paragraph\">The broader privacy issue is transparency.<\/p>\n<p class=\"wp-block-paragraph\">\u201cPeople should be clearly told when persistent device identifiers are being used, what activities may be linked to them, how long the data is retained, and how they can reduce the collection of such information,\u201d according to Lupton. \u201cThe fact that these records may help investigate serious crime does not eliminate the need for meaningful privacy protections and proper legal oversight.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>A recently released criminal complaint against Peter Stokes, an alleged member of the Scattered Spider cybercrime group, reveals previously unpublicized details about Windows telemetry. Microsoft has never exactly had a reputation for being privacy-focused, however the complaint reveals the important part played by Microsoft\u2019s Global Device Identifier (GDID), a persistent identifier tied to a Windows installation, in the case. GDID enabled investigators to correlate the&#8230; <\/p>\n<p class=\"more\"><a class=\"more-link\" href=\"https:\/\/newestek.com\/?p=16530\">Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16530","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16530"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16530\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}