A nineteen-year-old was stopped at Helsinki airport this year as he tried to board a flight to Japan. Finnish officers seized two two-terabyte drives. Part of what put his name on the US paperwork was a number sitting in his own Windows registry, one he almost certainly did not know existed. It had followed his machine across VPNs, proxy servers, and three countries.
That number is the Global Device Identifier, the GDID. It sits downstream of a Windows subsystem most people never think about: the Connected Devices Platform. If you build or defend Windows estates, both are worth understanding, because they are a clean example of something that is easy to forget when you are on the offensive side of a keyboard. The platform is designed to remember, and it does not forget just because you would like it to.
What the Connected Devices Platform actually does
CDP is the plumbing behind the cross-device features Microsoft has been adding since Windows 10. Phone Link, Nearby Sharing, the shared clipboard, cross-device notifications, and the Activity History timeline all sit on top of it. Two services carry the work, CDPSvc and CDPUserSvc, and they talk to Microsoft cloud services over the network to keep a device's relationships and activity in sync.
For a defender, the interesting part is the trail it leaves on disk. Under %LOCALAPPDATA%\ConnectedDevicesPlatform\ you find a per-user folder, usually named L.<username>, containing an SQLite database called ActivitiesCache.db. Introduced in Windows 10 version 1803 and on by default, it records application and file activity, including how long something was open, and it holds roughly the last thirty days. It has been a staple of Windows forensics for years. Open-source tooling such as WxTCmd parses it straight into a timeline, and in an incident it answers plain questions: what ran, which files were touched, and when. If the account was set to sync, the associated .cdp file even records the last sync time and the account identifier tied to it.
None of that is exotic. It is the point, though. The convenience feature and the forensic artifact are the same thing.
The GDID: a number the server hands you
Until recently almost nobody outside Microsoft had heard of the GDID, and that is not an accident. Microsoft documents it in exactly one place: a single column, GlobalDeviceId, in the Azure Monitor reference for Delivery Optimization, described only as an identifier used internally. It reached daylight because it turned up in a federal criminal complaint, after which researchers took the identifier apart to work out where it comes from.
The chain they reconstructed, corroborated by reporting on the complaint, runs like this. When a Windows device is provisioned against a Microsoft account, the Microsoft account service, wlidsvc, contacts login.live.com and receives back a Device PUID, a Passport Unique ID. It is a 64-bit value. Windows does not compute it from your hardware or serial numbers. The server assigns it, and the machine stores it in plain text in the registry under HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties. The Connected Devices Platform, running as cdp.dll inside CDPSvc, reads that value and registers the device into Microsoft's device directory graph. Delivery Optimization then reports it as GlobalDeviceId, written in the graph as g: followed by a long decimal.
The awkward property, for anyone hoping to stay anonymous, is how durable it is. It survives monthly Windows updates unchanged. Deleting the local ConnectedDevicesPlatform folder does not remove it, because the value is restored from the identity store. Signing in with a local account rather than a Microsoft account does not reliably avoid it either, because CDP has an anonymous device path that still produces an identifier. A clean reinstall issues a new GDID, but the device is bound to that fresh one the moment it registers again. It is not a bug or a novel vulnerability. It is a structural identifier baked into how Windows talks to Microsoft's cloud, and it reports through CDP and Delivery Optimization even when the classic telemetry service is switched off.
Why that durability became a court exhibit
In the case of Peter Stokes, filed in the Northern District of Illinois, the complaint reportedly used the GDID, alongside other telemetry, to follow one Windows machine across VPNs and proxies and three countries, and to link that machine to the accounts the suspect logged into. Stokes, known online as Bouquet, is accused of being an active member of Scattered Spider, tied to at least four intrusions including a 2025 attack on a luxury jewellery retailer with an eight-million-dollar demand. The affidavit is said to correlate the identifier's IP and browsing history with the accounts he used. He was stopped at Helsinki airport with those two drives, and the US is seeking his extradition.
Strip the technology away and the lesson is old. He trusted a VPN to make his location a mystery, and the operating system underneath the VPN was quietly maintaining a stable name for the machine the whole time. The anonymity layer he chose sat on top of an identifier he did not choose and could not easily remove.
Scattered Spider, and the run of arrests
Scattered Spider is a useful worked example because it is not a classic malware crew. Tracked by vendors as UNC3944, Octo Tempest, and 0ktapus, and part of the loose English-speaking network known as The Com, the group made its name on social engineering rather than exploits. The signature move, documented in a joint CISA and FBI advisory back in 2023, is a phone call to a help desk, posing as an employee who needs a password or MFA method reset, backed by adversary-in-the-middle phishing pages and SIM swapping to intercept codes. Once inside, they enrol their own device for MFA and operate as a legitimate user with valid credentials, which is precisely why they are hard to catch in the logs. They blend in.
The victim list is not small. MGM Resorts in 2023, with losses reported north of a hundred million dollars and casino systems down for days. Caesars, which reportedly paid around fifteen million. Clorox, which suffered months of product shortages. In 2025 a run through UK retail: Marks and Spencer, Harrods, and the Co-op. Then US insurers and airlines, one sector at a time. Prosecutors put the collective total at more than a hundred and fifteen million dollars in ransom payments across roughly a hundred and twenty intrusions.
And yet the names kept arriving. Noah Urban, known as Sosa and King Bob, was arrested in Florida in early 2024, convicted, and handed a ten-year sentence with thirteen million dollars in restitution ordered. Tyler Buchanan, an alleged leader, was picked up at Palma de Mallorca airport in June 2024 with twenty-seven million dollars in Bitcoin traced to him, then extradited to the US. In November 2024 the DOJ charged five members over the group's initial spree, which ran from September 2021 to April 2023 across dozens of companies. In July 2025 the UK's National Crime Agency arrested four people over the retail attacks and seized a large trove of equipment to work through.
The most recent UK case is the sharpest illustration. Thalha Jubair and Owen Flowers were each sentenced to five and a half years for the 2024 vishing attack that disabled 148 Transport for London systems and exposed data on an estimated ten million passengers, the largest cybercrime prosecution the UK has run. In chat logs entered as evidence, Flowers is recorded acknowledging that hitting hospital systems "might kill some 90-year-old on life support." His arrest halted intrusions against two US healthcare providers before they landed. Jubair, meanwhile, faces a separate US complaint that alleges he moved roughly eight and a half million dollars in cryptocurrency out of a server wallet while agents were executing a seizure warrant, which is not the act of someone who was ever truly invisible.
The mistakes are always the same mistakes
Pull back from the specifics and the same handful of failures recur across the whole group, and across cybercrime generally. Investigators reportedly linked members through hardware tied to their SIM-swapping activity and through Telegram handles that were not anonymised as carefully as their owners believed. Cryptocurrency, treated as untouchable by people who have not read a blockchain, gets followed to the point where it lands at a regulated exchange and meets a know-your-customer record. Infrastructure gets reused. Personal accounts get accessed from criminal machines. And now, a device identifier gets registered into a cloud graph before the first VPN even connects.
The theatrics at the end tell you how the group itself understood the position. In September 2025 an offshoot styling itself "scattered LAPSUS$ hunters 4.0" posted a run of apologies on Telegram, promising to give up ransomware, delete stolen data, and, in one member's phrasing, work toward using their skills for good. One said he was heading to rehab for sixty days. People who are winning do not issue press releases about going straight.
Why the takedowns are the right outcome, honestly caveated
It is worth being direct about the "good outcome" claim rather than sloganeering it. The harm here was real and specific: ten million people's data at TfL, months of shortages at Clorox, hospital systems that a participant openly discussed as potentially lethal, and hundreds of millions extracted from businesses that then spent millions more cleaning up. Putting young men in prison, seizing their drives at airports, and freezing their crypto is a proportionate response to that, and the deterrent value of naming people who spent years as handles in a chat room is not nothing.
The honest caveat is that attribution winning against individuals is not the same as the threat ending. Scattered Spider is a diffuse collective, not a company with a headquarters, and the playbook outlived the arrests. Within months of the retail-attack arrests, Mandiant was already tracking an identical help-desk vishing methodology under different branding. You can jail the people and the technique survives, because the technique was never the scarce resource. So the correct read is narrow and true: for the individuals, the trail is closing, and the platforms are getting better at remembering, not worse. For the ecosystem, this stays whack-a-mole for the foreseeable future.
What defenders take from it
Two things, and neither is a surprise. The first is that identity is the perimeter now. Scattered Spider barely touched an exploit; they talked their way past help desks and enrolled their own MFA. Phishing-resistant MFA, tighter help-desk verification for resets, and monitoring for new device enrolments do more against this group than another endpoint agent will.
The second is quieter. The same telemetry and cross-device machinery that makes Windows convenient is also, from the defender's chair, a rich and durable record. In an incident, the CDP artifacts and identity logs are often where the timeline actually lives. On the offensive side, that same permanence is why sustained cybercrime remains a losing position over a long enough window. The device keeps a diary, and increasingly it keeps one you cannot easily edit.