Every Windows machine carries a quiet identifier called a Global Device Identifier, and US court papers have just shown it can tie a computer to a person's online activity even when that person hides behind a VPN. For British firms already battered by the Scattered Spider crime group, the lesson is uncomfortable: the anonymity your staff assume from a VPN stops at the network, not the device on their desk.
The identifier surfaced in a superseding criminal complaint filed in the Northern District of Illinois against Peter Stokes, a 19-year-old dual US-Estonian citizen accused of belonging to Scattered Spider. According to the complaint, a Microsoft representative described the Global Device Identifier, or GDID, as a persistent, device-level identifier that uniquely marks an installation of Windows. Investigators used it to place a specific machine at the scene of a hack.
