A 19-year-old hacker used VPNs, tunneling tools, and rotated IPs...
IT Guy@T3chFalcon
11 views
Jul 06, 2026
Advertisement
1
A 19-year-old hacker used VPNs, tunneling tools, and rotated IPs across 3 countries. The FBI still caught him. Here's the Windows feature that made it possible and why it should concern everyone.
Peter Stokes, an alleged member of Scattered Spider (the group behind $100M+ in ransomware extortion), was arrested at Helsinki Airport this April. Court documents revealed a key piece of evidence: Microsoft's GDID.
What is a GDID?
GDID = Global Device Identifier. It's a unique code baked into every Windows installation. Microsoft uses it for telemetry, crash reports, feature usage, and license verification (it's why swapping your CPU can break your Windows activation).
What Microsoft gave the FBI:
→ Web activity with timestamps
→ Gaming history
→ IP addresses used over time
→ Tool usage (including Ngrok, a tunneling app)
→ Azure account activity
All tied to one persistent device fingerprint. Even though the VPN masked his IP, it didn't affect the GDID.
How they connected the dots:
Every time Stokes logged in to Snapchat, Apple, or Facebook from a new IP address, the GDID was there too. Investigators matched timestamps across platforms and countries: Tallinn, New York, Thailand, Germany. Different IPs. Same machine. Same person.
Microsoft had already identified him in October 2024 and filed a criminal referral. He was still 17. So they waited till He turned 18. Then they moved.
Yes, Stokes is accused of serious crimes. But the GDID data exists on every Windows machine, including yours. The infrastructure that handed his entire digital life to the FBI is the same infrastructure running on your laptop right now.
The unanswered questions:
- There's no public policy on when Microsoft shares GDID data
- No known opt-out mechanism
- No transparency report specifically covering GDID disclosures
- What other criminal referrals has Microsoft quietly filed?
Peter Stokes, an alleged member of Scattered Spider (the group behind $100M+ in ransomware extortion), was arrested at Helsinki Airport this April. Court documents revealed a key piece of evidence: Microsoft's GDID.
What is a GDID?
GDID = Global Device Identifier. It's a unique code baked into every Windows installation. Microsoft uses it for telemetry, crash reports, feature usage, and license verification (it's why swapping your CPU can break your Windows activation).
What Microsoft gave the FBI:
→ Web activity with timestamps
→ Gaming history
→ IP addresses used over time
→ Tool usage (including Ngrok, a tunneling app)
→ Azure account activity
All tied to one persistent device fingerprint. Even though the VPN masked his IP, it didn't affect the GDID.
How they connected the dots:
Every time Stokes logged in to Snapchat, Apple, or Facebook from a new IP address, the GDID was there too. Investigators matched timestamps across platforms and countries: Tallinn, New York, Thailand, Germany. Different IPs. Same machine. Same person.
Microsoft had already identified him in October 2024 and filed a criminal referral. He was still 17. So they waited till He turned 18. Then they moved.
Yes, Stokes is accused of serious crimes. But the GDID data exists on every Windows machine, including yours. The infrastructure that handed his entire digital life to the FBI is the same infrastructure running on your laptop right now.
The unanswered questions:
- There's no public policy on when Microsoft shares GDID data
- No known opt-out mechanism
- No transparency report specifically covering GDID disclosures
- What other criminal referrals has Microsoft quietly filed?
View Tweet