Loading story…
Former U.S. Army soldier Cameron John Wagenius, known online as kiberphant0m and cyb3rph4nt0m, was sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies from April 2023 through December 2024. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records, and was ordered to pay $294,978 in restitution.
Wagenius and co-conspirators used stolen network credentials—including credentials obtained through the SSH Brute tool he helped develop—to access victim systems, steal data, demand ransoms, and sell stolen information through Telegram, BreachForums, and XSS.is. Prosecutors said the group sought at least $1 million and used compromised records in SIM-swapping fraud; the activity was also linked to the 2024 Snowflake customer-data theft and extortion campaign, which affected more than 165 organizations, including AT&T.
See the reporting duties and controls this puts on the clock.
12 events from the most recent confirmed update back to the earliest known activity.
Moucka pleaded guilty for his role in the Snowflake hacking campaign.
Wagenius pleaded guilty to conspiracy to commit wire fraud, computer-fraud-related extortion, and aggravated identity theft.
Wagenius pleaded guilty to hacking AT&T and Verizon and to two counts of unlawfully transferring confidential phone records.
Authorities arrested Wagenius in Texas following the telecom and technology company intrusion and extortion campaign.
Wagenius published two posts disclosing confidential call records belonging to a government official and relatives of a former official, and threatened further releases unless paid.
Connor Riley Moucka and John Erin Binns were accused of stealing terabytes of data from more than 165 organizations through Snowflake services and demanding ransom payments.
Canadian authorities arrested alleged Wagenius accomplice Connor Riley Moucka at the request of the United States in connection with the Snowflake-related campaign.
AT&T disclosed that attackers had stolen call and text records involving nearly all of its cellular customers from its Snowflake account.
A Snowflake-related campaign used stolen credentials to access customer accounts lacking multifactor authentication, steal data, and demand ransoms. The activity affected more than 165 organizations, including AT&T, Ticketmaster, Santander, and other companies.
Cameron John Wagenius and co-conspirators obtained credentials for at least 10 organizations, accessed victim networks, stole data, and extorted organizations. The group used SSH Brute, Telegram, BreachForums, and XSS.is, and also sold data and used it in fraud including SIM-swapping.
Attackers stole call and text records involving nearly all AT&T cellular customers over a six-month period in 2022 from AT&T's Snowflake account.
A court sentenced Wagenius to 70 months in prison and ordered $294,978 in restitution for hacking and extorting technology and telecommunications companies. Prosecutors said the group attempted to extort at least $1 million.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcenextgov.com
Open sourcejustice.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Former U.S. Army soldier Cameron John Wagenius, known online as `kiberphant0m`, was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking, data theft and extortion targeting telecommunications companies and other organizations. Prosecutors said Wagenius and co-conspirators obtained credentials for at least 10 victims between April 2023 and December 2024, stole and sold sensitive data, demanded ransoms, and used records in SIM-swapping fraud. He pleaded guilty to wire-fraud conspiracy, computer-fraud-related extortion, aggravated identity theft, and unlawful transfers of confidential phone records. While stationed at Fort Cavazos, Wagenius used the credential-stealing tool SSH Brute, which he helped develop, and collaborated with Connor Moucka and alleged co-conspirator John Erin Binns. The operation was tied to the Snowflake customer-data theft wave, in which stolen credentials and accounts lacking multifactor authentication enabled theft of billions of records, including call and text metadata affecting more than 100 million AT&T customers. AT&T paid a $370,000 Bitcoin ransom; the group later posted purported call logs for Donald Trump and Kamala Harris and alleged NSA schematics. Wagenius also allegedly tried to sell stolen data to a foreign intelligence service and, while awaiting sentencing, sought exploit and escape-related guidance through other inmates' email accounts; authorities said they found no evidence he compromised Bureau of Prisons systems.
Sep 27, 2026
Connor Riley Moucka, a 26-year-old Canadian national, pleaded guilty in U.S. federal court for his role in a Snowflake-linked hacking and extortion campaign that compromised at least 165 organizations and exposed data tied to at least 100 million people. Prosecutors said the group used stolen credentials between February and October 2024 to access cloud-hosted customer environments, steal terabytes of sensitive data and billions of files, and extort victims by threatening to publish the information. Reported victims included **AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander,** and **LendingTree**, with stolen records including banking data, Social Security numbers, passport numbers, driver’s license numbers, and DEA registration numbers. Investigators said the intrusions were not caused by a compromise of Snowflake itself but by previously exposed customer credentials, many traced to infostealer malware infections dating back to 2020. Mandiant found that at least **79.7%** of the accounts used in the campaign had prior credential exposure, and observed the attackers using Snowflake’s **SnowSight** web interface, the **SnowSQL** CLI, **DBeaver Ultimate**, and a reconnaissance utility tracked as **FROSTBITE** to enumerate users, roles, IPs, session IDs, and organization names. Authorities said the conspiracy generated more than **$2.5 million** in ransom payments, while Moucka separately made about **$495,000** selling stolen data on cybercrime forums; he was extradited to the United States and is scheduled to be sentenced on October 27, 2026.
Aug 8, 2026
Cameron Curry, a former data analyst contractor from Charlotte, North Carolina, was sentenced to 24 months in federal prison for a cyber extortion campaign against a Washington, D.C.-based international technology company identified in reporting as Brightly Software. Prosecutors said Curry abused legitimate insider access to steal sensitive corporate records and employee information after learning his contract would not be renewed, then used the alias **"Loot"** to send more than 60 extortion emails between December 2023 and January 2024 demanding **$2.5 million in cryptocurrency**. The messages threatened to leak company and employee data, report the company to the SEC for failing to disclose a breach, and expose alleged pay disparities if payment was not made. A federal jury convicted Curry in March 2026 on six interstate extortion-related communications counts, and investigators tied him to the scheme through email metadata, account records, an Outlook address, and a Coinbase account linked to debit cards belonging to his mother and sister; an FBI search of his residence on January 24, 2024, led to the seizure of computer equipment and forensic evidence confirming he operated the **"Loot"** persona.
Aug 19, 2026