Former U.S. Soldier Sentenced to 70 Months for Hacking and Extorting Companies
Summary
Cameron John Wagenius received a 70-month sentence for hacking and extorting U.S. companies. Prosecutors said he and accomplices stole credentials, sold some data, and sought at least $1 million in extortion.
Key points
- Wagenius was sentenced to 70 months in prison and ordered to pay $294,978 in restitution.
- The attacks targeted at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024.
- Court documents say Wagenius and accomplices used the SSH Brute tool to steal network credentials and Telegram to share credentials and coordinate attacks.
- Prosecutors said the group threatened to publish stolen data on BreachForums and XSS[.]is, sold some data, and attempted to extort at least $1 million.
- The stolen data was also allegedly used in other fraud, including SIM-swapping.
- Wagenius pleaded guilty to hacking AT&T and Verizon and to additional identity theft, wire fraud conspiracy, and extortion charges.
Article Details
- Event Type
- Criminal sentencing for hacking and extortion of U.S. technology and telecommunications companies.
- Impact
- Cameron John Wagenius received a 70-month prison sentence and was ordered to pay $294,978 in restitution. Court documents say Wagenius and accomplices stole network credentials and customer records, attempted to extort at least $1 million, sold some stolen data, and used stolen data in other fraud, including SIM-swapping. Related Snowflake attacks were linked to breaches affecting hundreds of millions of people.
MITRE ATT&CK
T1110.001 · Password GuessingThe article says the attackers used the SSH Brute tool to steal login credentials; it does not specify the exact brute-force method.T1566 · PhishingThe article says stolen data was used to perpetuate other frauds, but does not provide enough detail to identify a specific phishing technique.T1567 · Exfiltration Over Web ServiceThe attackers threatened to publish stolen data on cybercrime forums and offered some stolen data for sale.
People
Cameron John WageniusFormer U.S. Army soldier sentenced to 70 months for hacking and extorting U.S. companies; also known online as kiberphant0m and cyb3rph4nt0m.Connor Riley MouckaAccused of involvement in the Snowflake hacking campaign; also known as Waifu and Judische.John Erin BinnsAccused of involvement in the Snowflake hacking campaign; also known as irdev and j_irdev1337.
Threat Actors
Vendors
Products
Tools
Countries
CanadaMoucka was arrested on October 30, 2024, in Canada at the request of the United States and pleaded guilty to his role in the Snowflake hacking campaign in August 2026.United StatesMoucka was arrested on October 30, 2024, in Canada at the request of the United States and pleaded guilty to his role in the Snowflake hacking campaign in August 2026.