Microsoft device telemetry key to unmasking alleged Scattered Spider hacker

Stokes allegedly hid his device behind a virtual private network (VPN) server which he then used to open an account on the ngrok secure tunnelling service.

But doing so did not mask the unique GDID of the Windows installation he used.

Microsoft identified that GDID for investigators after a court order, based on ngrok's time-stamped access records.