Overview of the Case
A former U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. Wagenius, also known online as 'kiberphant0m' and 'cyb3rph4nt0m,' was arrested in Texas in December 2024.
The Hacking and Extortion Scheme
Wagenius and his accomplices stole login credentials for the victim's networks using the SSH Brute hacking tool he helped develop. They used Telegram to transfer stolen credentials and plan their attacks. After data was stolen, Wagenius and his conspirators extorted the victim organizations both privately and in public forums. They threatened to post the stolen data on cybercrime forums such as BreachForums and XSS.is, and offered to sell stolen data for thousands of dollars.
The Role of Accomplices
Two of Wagenius' accomplices, Connor Riley Moucka (a.k.a. 'Waifu' and 'Judische') and John Erin Binns (a.k.a. 'irdev' and 'j_irdev1337'), were accused in November 2024 of breaching and stealing terabytes of data from more than 165 organizations using the services of Snowflake cloud storage company and demanding ransom payments to delete the stolen information and not leak it online. Moucka was arrested in Canada on October 30, 2024, and pleaded guilty to his role in the Snowflake hacking campaign in August 2026.
The Impact of the Data Breaches
Data breaches linked to Snowflake attacks affected hundreds of millions of people, customers of AT&T, Ticketmaster, Santander, Los Angeles Unified, QuoteWizard/LendingTree, Pure Storage, Advance Auto Parts, and Neiman Marcus. Snowflake announced it would enforce multi-factor authentication (MFA) and require customers to choose passwords at least 14 characters long.
Lessons Learned
This case highlights the importance of robust cybersecurity measures, including multi-factor authentication, strong password policies, and the use of secure cloud storage services. It also underscores the risks associated with using public messaging platforms like Telegram for sensitive communications and the potential consequences of data breaches.
Additional Information
For more information on cybersecurity and data protection, consider the following resources:
- Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
- See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
- Monitor, analyze, and promptly mitigate risks across your external digital landscape with the CTM360. Join our Community Edition.
- Alert volume shouldn't be deciding your detection coverage. See where the gaps are and how to fund the fix.
Comments