Seventh Scattered Spider Arrest Made as the Campaign Continued

US authorities arrested a 19-year-old Texas resident on 5 December 2025 in connection with the Scattered Spider cluster, reported as the seventh arrest associated with it.

The standard model of disruption assumes that a criminal enterprise has key personnel — operators, developers, negotiators — and that removing them degrades capability. It is the reasoning behind the takedowns this desk filed at 26-0624 and 26-0522, and it demonstrably works against organisations built that way.

This cluster is not built that way. There is no infrastructure to seize, no codebase only a few people can maintain, and no hierarchy in which anybody is load-bearing. The technique — persuading a service desk to reset credentials — requires a phone and knowledge that is now widely distributed.

Removing seven participants from a population defined by willingness rather than by skill leaves the population substantially intact.

Against infrastructure-dependent operations, enforcement produces measurable effect: LockBit’s backend seizure genuinely disrupted it, and the BreachForums takedown at 25-1014 removed a functioning marketplace.

Against capability-light, socially organised activity, enforcement removes individuals and leaves the method. This is a sharper version of the finding at 25-0213, where sanctions failed against a state operation: the tool has to match the structure of what it is aimed at, and the same tool produces very different results against different structures.

Seven arrests, one conviction and a ten-year sentence do change the calculation for a prospective participant. This is a population of young people for whom prosecution was previously abstract.

That is a deterrence argument, not a disruption argument, and its effects are slow and unmeasurable. It may be the more important of the two, and neither this desk nor anyone else can currently show it.