Malware

SSH Brute

SSH Brute is a custom hacking tool used by Cameron John Wagenius (alias "kiberphant0m") and his co-conspirators between April 2023 and December 2024 to obtain network credentials from major telecommunications companies, including AT&T and Verizon. The tool was specifically designed for brute-forcing SSH credentials, enabling unauthorized access to targeted networks. Compromised credentials were shared via encrypted Telegram chats and used to facilitate further cybercriminal activities, such as extortion, SIM-swapping, and data theft. The group advertised and sold stolen data on cybercrime forums like BreachForums and XSS.is, and used the access gained through SSH Brute to attempt extortion of at least $1 million from victims. The malware was part of a broader campaign targeting at least ten organizations, primarily in the telecommunications sector. High-confidence indicators include its use for SSH brute-forcing, credential theft, and its role in enabling subsequent fraud and extortion schemes.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence9

"The group traded hundreds of credentials" and "discussed using them to gain unauthorized access to other parts of victims' networks."

T1078.004Cloud AccountsEvidence1

Wagenius and one of his co-conspirators, Connor Moucka, attempted to extort more than 10 organizations after stealing credentials and breaking into cloud platforms used by AT&T and other major companies.

Persistence

2 techniques

T1078Valid AccountsEvidence9

"The group traded hundreds of credentials" and "discussed using them to gain unauthorized access to other parts of victims' networks."

T1078.004Cloud AccountsEvidence1

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence9

"The group traded hundreds of credentials" and "discussed using them to gain unauthorized access to other parts of victims' networks."

T1078.004Cloud AccountsEvidence1

Stealth

2 techniques

T1078Valid AccountsEvidence9

"The group traded hundreds of credentials" and "discussed using them to gain unauthorized access to other parts of victims' networks."

T1078.004Cloud AccountsEvidence1

Credential Access

3 techniques

T1110Brute ForceEvidence4

The group obtained login credentials for the organizations’ protected computer networks, in part by using a hacking tool called SSH Brute that Wagenius helped develop.

T1110.001Password GuessingEvidence5

"Wagenius and his co-conspirators obtained login credentials with a hacking tool he helped develop called SSH Brute, among other methods."

T1110.002Password CrackingEvidence1

Wagenius and his conspirators obtained these credentials using a hacking tool that Wagenius helped develop called SSH Brute, among other means.

Lateral Movement

1 technique

T1021.004SSHEvidence1

“SSH Brute ... was used to obtain login credentials.”

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

hackreadNews

Jul 16, 2025

Ex US Soldier Cameron Wagenius Guilty in Telecom Hacking and Extortion

SSH Brute is a hacking tool used to perform brute-force attacks against SSH services to obtain login credentials for secure computer networks.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SSH Brute