Former Army Soldier Sentenced to 70 Months for Cyberattacks on AT&T, Snowflake Customers and Others
Summary
Cameron John Wagenius was sentenced to 70 months in prison for cybercrime that included stealing credentials, targeting cloud platforms and attempting to extort organizations including AT&T. He was also ordered to pay nearly $295,000 in restitution.
Key points
- Wagenius pleaded guilty in July 2025 and was sentenced to 70 months in prison; he must pay nearly $295,000 in restitution.
- He used the aliases “kiberphant0m” and “cyb3rph4nt0m” and helped develop the SSH Brute tool, which officials said he used to steal credentials.
- Wagenius and co-conspirators used stolen credentials to access cloud platforms and stole sensitive records from multiple organizations.
- Prosecutors said the group attempted to extort more than 10 organizations; Wagenius was directly involved in attempted extortion totaling more than $1 million.
- AT&T said attackers accessed its Snowflake environment in April and stole six months of phone and text records for nearly all its customers.
- The broader Snowflake compromise affected more than 165 customer environments; Wagenius was linked to records stolen in attacks on Snowflake customer databases.
Article Details
- Event Type
- Sentencing for cyber intrusions, data theft, and extortion
- Impact
- Cameron John Wagenius was sentenced to 70 months in prison and ordered to pay almost $295,000 in restitution. Prosecutors said Wagenius and his co-conspirators stole billions of sensitive records and received more than $2.5 million in extortion payments combined. Officials said Wagenius was directly involved in attempts to extort multiple organizations for a combined total of more than $1 million.
MITRE ATT&CK
Threat Actors
Cameron John WageniusSentenced for the intrusions and extortion attempts; identified himself online as kiberphant0m and cyb3rph4nt0m.Connor MouckaCo-conspirator who pleaded guilty to a central role in the compromise of Snowflake customer environments.cyb3rph4nt0mOnline criminal-forum alias used by Cameron John Wagenius.John Erin BinnsDescribed by prosecutors as an alleged co-conspirator in the data theft and extortion spree.kiberphant0mOnline criminal-forum alias used by Cameron John Wagenius.