Executive Summary
The arrest and extradition of an alleged Scattered Spider member drew attention for more than the charges themselves. The most revealing detail appeared inside the court documents: Microsoft telemetry associated with a Global Device Identifier, or GDID, helped investigators connect online activity to a specific Windows installation.
According to the complaint, Microsoft records linked the same GDID to ngrok activity, public IP addresses, timestamps, and browsing activity. This gave investigators a device-level correlation point that remained useful even when VPNs, proxy infrastructure, and anonymization techniques were involved.
This case matters because it shows how endpoint telemetry can support cybercrime attribution. It also highlights an under-discussed Windows identifier that many researchers and threat actors may not fully understand.
Quick Definition
GDID, or Global Device Identifier, is a persistent Microsoft device-level identifier associated with a Windows installation. According to court documents, it can uniquely identify a Windows installation across certain Microsoft services and scenarios, remains consistent across Windows updates, and changes after a Windows reinstall.
Key Takeaways
- The case involves an alleged Scattered Spider member extradited from Finland to the United States.
- Microsoft telemetry associated with a GDID helped investigators correlate activity to a Windows installation.
- The GDID observed in the complaint was
g:6755467234350028. - The telemetry was linked to ngrok activity, public IP addresses, timestamps, and browsing activity.
- GDID appears to be tied to a Windows installation rather than permanently bound to hardware.
- A Windows reinstall can generate a new GDID.
- The case shows how Microsoft telemetry can support cybercrime attribution when combined with other investigative evidence.
- For defenders and researchers, GDID is an important but under-discussed forensic signal.
Introduction
On July 1, 2026, the U.S. Department of Justice announced the extradition of an alleged Scattered Spider member from Finland to the United States, marking another significant milestone in the ongoing international effort to dismantle one of the most prolific cybercriminal groups operating today. The suspect, 19-year-old Peter Stokes, faces charges of conspiracy, computer intrusion, and fraud for his alleged role in a series of attacks that have collectively resulted in more than 100 network intrusions and over $100 million in ransom payments.
Peter Stokes, a 19-year-old Estonian-US dual citizen known by the online alias “Bouquet”, was apprehended at Helsinki Airport in Finland while attempting to board a flight to Japan.
At first glance, this appears to be just another cybercriminal arrest. Law enforcement agencies announce the arrest of threat actors on a regular basis, and such cases have become increasingly common. However, this case stands out for a very different reason.
The biggest surprise isn’t the arrest itself, It’s what appears on page 8 of the indictment. For security researchers and threat actors alike, this section is arguably the most revealing part of the document. What it uncovers goes well beyond a typical OPSEC mistake, offering rare insight into the inner workings of the operation and how investigators ultimately connected the dots.
Why This Case Matters
Cybercriminal attribution often depends on mistakes: reused infrastructure, exposed accounts, weak OPSEC, leaked identities, or overlapping IP activity.
This case shows a different type of attribution path.
Instead of relying only on a visible OPSEC failure, investigators used telemetry associated with a Windows installation. The GDID became a device-level correlation point that helped connect different activities back to the same environment.
That makes this case important for three audiences:
Threat Intelligence Researchers
The case provides a public example of how device telemetry can support attribution when combined with account records, infrastructure logs, and timestamps.
Digital Forensics Teams
The GDID shows how persistent device identifiers may become relevant in investigations involving Windows systems and Microsoft services.
Threat Actors
The case demonstrates that VPNs and anonymization tools may not fully break attribution if the same operating system installation continues generating identifiable telemetry.
Microsoft Telemetry Exposed the Operator
According to the court documents, Microsoft provided telemetry associated with the suspect’s Global Device Identifier (GDID) to the FBI.
The GDID is a unique identifier assigned to a Windows installation.
The identifier remains consistent unless the operating system is reinstalled or wiped.
Microsoft telemetry linked the same GDID across multiple activities.
The telemetry included the device’s public IP addresses.
The telemetry recorded timestamps of internet activity.
The telemetry showed web browsing activity.
The telemetry identified the use of ngrok from the same device.
The telemetry correlated the device with infrastructure used during the intrusion.
This evidence allowed investigators to tie activity back to a single Windows installation despite the use of VPNs and other anonymization techniques.
Video: GDID – Microsoft’s Secret Windows Tracker That Can’t Be Turned Off (by Rob Braxman Tech)
According to the court documents, Microsoft provided Windows telemetry associated with the suspect’s Global Device Identifier (GDID) to the FBI.
GDID observed in the investigation: g:6755467234350028.
However, this Microsoft identifier is largely unknown to many security researchers and threat actors alike. The court documents also suggest that the full extent of the telemetry associated with the Global Device Identifier (GDID)
What Is GDID?
GDID stands for Global Device Identifier. In the court documents, Microsoft describes it as a persistent identifier tied to a Windows installation.
In practical terms, GDID can be understood as a device-level identity signal used across certain Microsoft services and telemetry scenarios. It is not simply an IP address, browser cookie, or hardware serial number.
The important point is persistence. If the same Windows installation continues to be used, the GDID can remain stable across operating system updates. However, if Windows is reinstalled, the GDID can change.
GDID vs. Other Identifiers
How Windows OOBE May Relate to Device Identity
The author revisited network traffic generated during the Windows Out-of-Box Experience (OOBE) using Fiddler to understand how Windows Autopilot identifies a device. Windows 11 was unsuitable for this analysis because OOBE components run under the defaultUser0 account instead of Administrator, preventing Fiddler from capturing all UWP application traffic. Therefore, Windows 10 was used instead.
While previous analysis revealed how Autopilot profiles are delivered to a device, it did not explain how Microsoft associates an uploaded Autopilot hardware hash with a specific device. Network captures showed that, before requesting an Autopilot profile, the device first registers itself with Microsoft’s legacy Passport.NET service by sending a request to https://login.live.com/ppsecure/deviceaddcredential.srf. During this registration, the device generates and submits a unique membername, password, and additional device information, indicating that device identification relies on more than just the uploaded hardware hash.
According to the court report, reinstalling the Windows operating system can result in the generation of a new GDID (Passport Unique ID/PUID), indicating that the identifier is tied to the operating system’s device registration process rather than being permanently bound to the underlying hardware.
Microsoft Edge Diagnostic Telemetry and Browsing Activity
The court reporting also raises questions about browsing activity linked to the GDID.
One plausible source is Microsoft Edge diagnostic telemetry. Microsoft’s own policy documentation states that optional diagnostic data can include URLs of pages visited and per-page usage data when URL diagnostic reporting is enabled.
This does not mean every Edge installation sends the same level of browsing data in every environment. Diagnostic data depends on settings, policies, user choices, and enterprise configuration.
However, the case shows why browser telemetry matters in investigations. If web activity can be associated with a persistent device identifier, it may help connect account creation, infrastructure access, and other online behavior to the same endpoint.
Why This Matters for Threat Intelligence and Digital Forensics
This case matters for defenders because it shows how telemetry can support attribution, incident reconstruction, and infrastructure correlation.
For threat intelligence teams, GDID highlights the importance of device-level identifiers in modern investigations. Threat actors may rotate infrastructure, accounts, VPNs, and aliases, but persistent identifiers can still create continuity across activity.
For digital forensics teams, the case reinforces a broader lesson: endpoint telemetry, cloud records, browser diagnostics, and account activity should be analyzed together. The value is not in one log source. The value is in how multiple sources connect.
For enterprise security leaders, the case also raises governance questions around telemetry, privacy, retention, legal access, and diagnostic data configuration.
Defensive and Governance Takeaways
This case is not only relevant to law enforcement. It is also relevant to enterprise security and privacy governance.
Organizations should consider the following:
- Review Windows and Microsoft Edge diagnostic data policies.
- Understand what telemetry is enabled across managed endpoints.
- Document how diagnostic data settings are configured in enterprise environments.
- Align telemetry collection with legal, compliance, and privacy requirements.
- Preserve endpoint and identity logs during incident response.
- Correlate device, browser, identity, and network activity during investigations.
- Strengthen help desk identity verification to reduce social engineering risk.
- Use phishing-resistant MFA for high-risk and privileged accounts.
The main lesson is not that telemetry alone solves attribution. The lesson is that telemetry becomes valuable when combined with identity records, infrastructure logs, and investigative context.
What Researchers Should Investigate Next
The court documents make GDID publicly visible, but many technical details remain under-documented.
Researchers should investigate:
- where GDID is stored locally
- how it is generated
- which services receive it
- how it relates to Passport Unique ID or device PUID
- how it changes after reinstall
- whether enterprise policies reduce or prevent certain telemetry associations
- how Microsoft Edge diagnostic telemetry references device identifiers
- which forensic artifacts remain available locally
This is an important area for digital forensics, privacy research, and threat intelligence.
The Best “Go Paid” Deal on Substack! You Get REAL Stuff!!
Go paid at the $5 a month level, and we will send you both the PDF and e-Pub versions of Etienne’s new book: To See the Cage Is to Leave It - 25 Techniques the Few Use to Control the Many and a coupon code for 10% off anything in the https://artofliberty.org/store/.
Go paid at the $50 a year level, and we will send you a free paperback edition of Etienne’s new book: To See the Cage Is to Leave It - 25 Techniques the Few Use to Control the Many OR “Government” - The Biggest Scam in History… Exposed! OR a 64GB Liberator flash drive if you live in the US. If you are international, we will give you a $10 credit towards shipping if you agree to pay the remainder.
Support us at the $250 Founding Member Level and get a signed high-resolution hardcover of “Government” - The Biggest Scam in History... Exposed! + Liberator flash drive + a signed high-resolution hardcover of Etienne’s new book: To See the Cage Is to Leave It - 25 Techniques the Few Use to Control the Many + everything else in our “Everything Bundle” of the best in voluntaryist thought delivered domestically. International pays shipping. Our only option for signed copies besides catching Etienne at an event.
