Loading story…
Canadian hacktivist Aubrey Cottle, also known as Kirtaner and previously linked to Anonymous, was sentenced to 18 months in jail for his role in the 2021 cyberattack on the Republican Party of Texas website. Prosecutors said the operation involved compromising hosting provider Epik, defacing texasgop.org in protest of a Texas abortion law, and stealing about 180 GB of backup data containing sensitive information tied to party staff and donors.
Court records show Cottle pleaded guilty to damaging data, unauthorized or illegal use of computer services, and violating bail conditions by accessing the internet without supervision. He has already received credit for time served and is expected to remain in custody for roughly 175 more days, while separate U.S. charges tied to the same incident remain a risk if extradition proceeds, potentially exposing him to additional prison time.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Aubrey Cottle was sentenced to 18 months in jail after pleading guilty to damaging data, unauthorized or illegal use of computer services, and violating bail conditions by using the internet without supervision. He received credit for time already served and was reported as expected to remain in custody for another 175 days.
The article states that U.S. authorities unsealed criminal charges in 2025 related to the Texas GOP cyberattack. If extradited to the United States, Cottle could face up to five additional years in prison.
On 2021-09-11, the Republican Party of Texas website was defaced in protest of a Texas abortion law after its web host Epik was compromised. The attack also involved the theft and online sharing of 180 gigabytes of backup data containing sensitive information on staff and donors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. prosecutors indicted Swiss national Till Kottmann, also known as **"deletescape"** and **"tillie crimew,"** on charges including conspiracy, wire fraud, and aggravated identity theft for allegedly hacking dozens of companies and government entities, stealing confidential data and credentials, and publishing material from more than 100 victims online. The indictment says the activity began in 2019 and included intrusions into source code repositories and other systems at major organizations including **Microsoft, Intel, Nintendo, Nissan, Daimler, Disney**, a Washington state agency, and a U.S. government contractor; the FBI also seized the **`git.rip`** domain that investigators said was used to leak stolen data. The case also linked Kottmann to the high-profile **Verkada** intrusion, in which exposed super-admin credentials were allegedly used to access more than **150,000 surveillance cameras** at prisons, hospitals, warehouses, schools, and Tesla facilities. U.S. authorities, working with Swiss counterparts, said search warrants were executed in Lucerne and devices were seized, while media reports noted Kottmann had described the attacks as anti-capitalist hacktivism and "easy" acts of anarchism; prosecutors instead characterized the campaign as criminal theft, fraud, and identity abuse affecting both private companies and public-sector targets.
Jun 29, 2026
Former U.S. Army soldier Cameron John Wagenius, known online as `kiberphant0m`, was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking, data theft and extortion targeting telecommunications companies and other organizations. Prosecutors said Wagenius and co-conspirators obtained credentials for at least 10 victims between April 2023 and December 2024, stole and sold sensitive data, demanded ransoms, and used records in SIM-swapping fraud. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records. While stationed at Fort Cavazos, Wagenius used the credential-stealing tool SSH Brute, which he helped develop, and collaborated with Connor Moucka and alleged co-conspirator John Erin Binns. The operation was tied to the Snowflake customer-data theft wave, in which stolen credentials and accounts lacking multifactor authentication enabled theft of billions of records, including call and text metadata affecting more than 100 million AT&T customers. AT&T paid a $370,000 Bitcoin ransom; the group later posted purported call logs for Donald Trump and Kamala Harris and alleged NSA schematics. Wagenius also allegedly tried to sell stolen data to a foreign intelligence service and, while awaiting sentencing, sought exploit and escape-related guidance through other inmates' email accounts; authorities said they found no evidence he compromised Bureau of Prisons systems.
Sep 28, 2026
Former U.S. Army soldier Cameron John Wagenius, known online as `kiberphant0m` and `cyb3rph4nt0m`, was sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies from April 2023 through December 2024. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records, and was ordered to pay **$294,978** in restitution. Wagenius and co-conspirators used stolen network credentials—including credentials obtained through the SSH Brute tool he helped develop—to access victim systems, steal data, demand ransoms, and sell stolen information through Telegram, BreachForums, and XSS.is. Prosecutors said the group sought at least $1 million and used compromised records in SIM-swapping fraud; the activity was also linked to the 2024 Snowflake customer-data theft and extortion campaign, which affected more than 165 organizations, including AT&T.
Sep 28, 2026