Former Army Soldier Sentenced to 70 Months for Cyberattacks and Extortion Attempts
Summary
Cameron John Wagenius was sentenced to 70 months in prison for cyberattacks and extortion attempts targeting AT&T and other organizations, including theft of sensitive records from cloud platforms.
Key points
- Wagenius, a former active-duty Army soldier, pleaded guilty and was sentenced to 70 months in prison; he was also ordered to pay nearly $295,000 in restitution.
- He and co-conspirators stole credentials to access cloud platforms used by AT&T and other organizations, then attempted to extort victims.
- Wagenius used the aliases “kiberphant0m” and “cyb3rph4nt0m” and used SSH Brute, a tool officials said he helped develop, to steal credentials.
- Wagenius attempted to extort $500,000 from AT&T and leaked stolen call records, according to a researcher cited by the article.
- AT&T confirmed that cybercriminals accessed its Snowflake environment in April and stole six months of phone and text records belonging to nearly all its customers.
- Prosecutors said Wagenius and co-conspirators stole billions of sensitive records and received more than $2.5 million in extortion payments combined.
Article Details
- Victim Organization
- AT&T; Ticketmaster; Advance Auto Parts; Santander; other organizations not named in the source
- Incident Type
- Cybercrime campaign involving credential theft, unauthorized access to cloud platforms and Snowflake customer environments, data theft, and attempted extortion
- Data Types Exposed
- Phone and text records, including non-content call detail records
- Sensitive records
- Identification documents
- Affected Records
- Prosecutors said Wagenius, Moucka, and Binns stole billions of sensitive records combined. AT&T confirmed that six months of phone and text records belonging to nearly all its customers were stolen.
- Operational Impact
- Unauthorized access to cloud platforms and Snowflake customer environments, with theft of sensitive data. The source does not report specific service disruption.
- Ransom Or Extortion
- Wagenius made multiple failed attempts to extort $500,000 from AT&T and was directly involved in attempted extortion targeting multiple organizations for a combined amount exceeding $1 million. Prosecutors said Wagenius, Moucka, and Binns received more than $2.5 million in extortion payments combined.
- Claim Status
- confirmed
People
Allison NixonChief research officer at Unit 221B who previously told CyberScoop that Wagenius leaked stolen call records of President Donald Trump as part of attempted extortion.Cameron John WageniusFormer Army soldier who pleaded guilty and was sentenced for cybercrime, data theft, and attempted extortion.Connor MouckaCo-conspirator who pleaded guilty to a central role in the compromise of Snowflake customer environments.John Erin BinnsAlleged co-conspirator; the source says he was not in U.S. custody at the time of reporting.
Threat Actors
Connor MouckaNamed co-conspirator who pleaded guilty to a central role in the Snowflake customer-environment compromise.cyb3rph4nt0mAlias used by Cameron John Wagenius on online criminal forums.John Erin BinnsNamed alleged co-conspirator in the campaign, according to prosecutors.kiberphant0mAlias used by Cameron John Wagenius on online criminal forums.