Actor Profile

Cameron John Wagenius (aliases 'kiberphant0m', 'cyb3rph4nt0m'), a 21-year-old former U.S. Army soldier, conducted hacking and extortion operations while on active duty between April 2023 and December 2024. Wagenius operated as part of a conspiracy with at least two known accomplices, Connor Riley Moucka (aka 'Waifu', 'Judische') and John Erin Binns (aka 'irdev', 'j_irdev1337'). The actor's primary motivation was financial gain, targeting U.S. technology and telecommunications companies to steal sensitive data for extortion and resale. Wagenius was arrested in Texas in December 2024, pleaded guilty to multiple charges including unlawful transfer of confidential phone records, aggravated identity theft, conspiracy to commit wire fraud, and extortion related to computer fraud, and was sentenced to 70 months in prison with $294,978 in restitution.

TTPs (Tactics, Techniques, Procedures)

Initial access was achieved through credential theft using an SSH brute-force tool ('SSH Brute') that Wagenius helped develop (T1110.001 - Brute Force: Password Guessing). The group used Telegram for operational coordination and transfer of stolen credentials (T1102 - Web Service for C2). Post-compromise activities included data exfiltration of sensitive customer records and phone data from telecommunications databases (T1567 - Exfiltration Over Web Service). The actors conducted extortion operations both privately and publicly via cybercrime forums including BreachForums and XSS.is (T1486 - Data Encrypted for Impact / T1657 - Financial Theft). Stolen data was monetized through direct sales on underground forums and used to enable secondary fraud schemes including SIM-swapping attacks (T1528 - Steal Application Access Token). The conspiracy attempted to extort at least $1 million from victim organizations.

Targets & Patterns

The actor targeted at least 10 U.S. technology and telecommunications companies, with confirmed victims including AT&T and Verizon. The telecommunications sector was specifically targeted for access to sensitive customer records and confidential phone data, which provided high-value extortion leverage and resale opportunities on cybercrime forums. The selection of telecom targets also enabled secondary criminal activities such as SIM-swapping fraud, which requires access to carrier systems and customer authentication data. The pattern suggests targeting organizations with large customer databases containing personally identifiable information (PII) and communications metadata that commands premium prices in underground markets.

Historical Context

Wagenius's accomplices Connor Riley Moucka and John Erin Binns were separately charged in November 2024 for their roles in the large-scale Snowflake cloud storage breach campaign, which compromised over 165 organizations and affected hundreds of millions of individuals. Moucka was arrested in Canada in October 2024 and pleaded guilty in August 2026. The Snowflake campaign impacted major organizations including AT&T, Ticketmaster, Santander, Los Angeles Unified, QuoteWizard/LendingTree, Pure Storage, Advance Auto Parts, and Neiman Marcus. This connection indicates Wagenius operated within a broader cybercriminal network responsible for one of the most significant data breach campaigns in recent history. The Snowflake incidents prompted the company to enforce MFA and implement 14-character minimum password requirements.

Defensive Recommendations

  • Implement robust SSH access controls with rate limiting and account lockout policies to defend against brute-force attacks (T1110.001); monitor for repeated failed authentication attempts via security logging
  • Deploy multi-factor authentication (MFA) across all remote access points and privileged accounts, particularly for cloud storage and database systems containing sensitive customer data
  • Monitor for credential usage anomalies and impossible travel scenarios; implement behavioral analytics to detect compromised credentials being used from unexpected geolocations or at unusual times
  • Establish threat intelligence feeds monitoring cybercrime forums (BreachForums, XSS.is) for mentions of your organization, leaked credentials, or data offerings that may indicate an active breach
  • Harden telecommunications and customer database access with network segmentation, privileged access management (PAM), and data loss prevention (DLP) controls to limit exfiltration of bulk customer records

---

# Geopolitical Context

Geopolitical Context

This case represents a domestic insider threat involving an active-duty U.S. military service member conducting financially motivated cybercrime against critical infrastructure sectors. The incident underscores vulnerabilities in personnel security and the convergence of military access with civilian cybercriminal ecosystems. Wagenius's use of established cybercrime forums (BreachForums, XSS.is) and collaboration with co-conspirators linked to the broader Snowflake compromise campaign—affecting over 165 organizations and hundreds of millions of individuals—illustrates the professionalization and commoditization of access-based extortion. The case does not appear to involve state-sponsored activity or espionage; rather, it reflects opportunistic exploitation of cloud service provider security gaps and credential-based attacks for financial gain. The prosecution and sentencing demonstrate U.S. law enforcement's capacity to pursue domestic cyber actors, though the international dimension (co-conspirator arrest in Canada) highlights cross-border coordination challenges.

State Actor Alignment

No evidence of state sponsorship or alignment is present in available reporting. Wagenius and co-conspirators operated as financially motivated cybercriminals within the broader underground economy. The case is a domestic law enforcement matter handled by the U.S. Department of Justice, with international cooperation from Canadian authorities for the arrest of co-conspirator Connor Riley Moucka. The involvement of an active-duty U.S. Army soldier raises questions about insider risk management within the U.S. military, but does not indicate foreign state involvement or espionage objectives. The targets—U.S. technology and telecommunications firms—are consistent with financially motivated crime rather than strategic intelligence collection.

Business Impacty pro region

The Snowflake-related breaches linked to Wagenius's co-conspirators had global impact, affecting major U.S. corporations (AT&T, Verizon, Ticketmaster, Santander) and exposing hundreds of millions of customer records. This incident may prompt increased scrutiny of cloud service provider security practices across North America and Europe, particularly regarding credential management and multi-factor authentication enforcement. The case reinforces concerns about supply chain and third-party risk in cloud environments, with potential regulatory implications for data protection regimes (e.g., GDPR in Europe, state-level privacy laws in the U.S.). For allied nations, the involvement of a U.S. military insider in cybercrime may raise questions about personnel vetting and continuous monitoring practices within defense establishments. The successful prosecution may serve as a deterrent signal to other potential insider threats, though the scale of financial gain ($1 million attempted extortion, successful data sales) suggests persistent incentives for such activity.

Forecast

If cloud service providers continue to rely on weak authentication mechanisms and customers fail to enforce multi-factor authentication, similar credential-based attacks targeting shared infrastructure are likely to persist. Should Snowflake's mandatory MFA and password complexity requirements prove effective, attackers may shift tactics toward social engineering, SIM-swapping (already employed by Wagenius's group), or exploitation of API keys and service accounts. If U.S. military and intelligence agencies do not enhance insider threat detection and continuous vetting, additional cases involving active-duty personnel engaged in cybercrime or espionage may emerge. The sentencing of Wagenius and ongoing prosecution of co-conspirators may temporarily disrupt this specific criminal network, but the established infrastructure of cybercrime forums and credential marketplaces will likely enable other actors to fill the void. If international law enforcement cooperation continues to improve, cross-border arrests and prosecutions of cybercriminals operating from permissive jurisdictions may increase, though significant safe havens remain.