Former US Army Soldier Sentenced for Telecom Hacking Spree
Cameron Wagenius gets 70 months for stealing records and attempted extortion.
1Military background in cybercrime
Cameron Wagenius, a 22-year-old former US Army soldier, conducted his hacking campaign while on active duty. Stationed in both South Korea and Texas during the crimes, he used his technical skills for illegal activities rather than military purposes. The case highlights concerning vulnerabilities when individuals with security clearances turn malicious. Wagenius's military status adds severity to the charges, as he violated both civilian laws and military conduct standards.
2Sophisticated attack methods
Wagenius and three co-conspirators used multiple techniques to breach at least ten organizations' networks between April 2023 and December 2024. Their primary tool was SSH Brute, a hacking tool Wagenius helped develop for credential theft. The group exchanged stolen login details via Telegram group chats, discussing how to escalate access within victim networks. This methodical approach allowed them to maintain prolonged unauthorized access to sensitive systems.
3Massive data exfiltration
The hacking group stole hundreds of thousands of customer records from multiple telecom companies and other organizations. Court documents reveal they traded hundreds of credentials among themselves, indicating systematic harvesting of access points. The stolen data included confidential phone records, which were later used for extortion attempts and fraud schemes like SIM swapping. The scale suggests vulnerabilities in telecom companies' data protection measures during this period.
4Multi-platform extortion scheme
Wagenius's group monetized stolen data through platforms including XSS, BreachForums, X, and Telegram. Some posts offered data for direct sale, while others threatened publication unless victims paid ransoms. The Justice Department confirmed at least $1 million in attempted extortion demands, with some successful sales. This hybrid approach—combining dark web sales with direct victim targeting—maximized their profit potential from the stolen information.
5Connection to Snowflake attacks
Wagenius has been linked to the high-profile 2024 Snowflake extortion campaign affecting AT&T and Verizon. After arrests in that case, an account tied to Wagenius claimed possession of sensitive AT&T records belonging to prominent political figures. This connection suggests his involvement in multiple major cybercrime operations during a concentrated timeframe, demonstrating a pattern of targeting critical infrastructure.
6Legal consequences and sentencing
After pleading guilty in March 2025 to unlawful data transfer, Wagenius later admitted to wire fraud conspiracy, computer extortion, and aggravated identity theft. US District Judge Lauren King emphasized the national security implications during sentencing, citing Wagenius's 'shocking disregard for US safety.' The 70-month prison term reflects the severity of crimes committed by someone with military training against critical communications infrastructure.
7Financial penalties imposed
Beyond prison time, Wagenius was ordered to pay $294,978 in restitution to victims. This amount likely represents a portion of the financial damages caused by his actions, including direct theft and secondary fraud enabled by stolen data. The restitution order complements the prison sentence by ensuring some financial accountability, though many impacts of such large-scale data breaches remain difficult to quantify monetarily.
8Broader security implications
This case exposes critical vulnerabilities in telecom security and military personnel screening. The duration of Wagenius's campaign—spanning nearly two years across continents—reveals detection gaps in both corporate networks and military oversight. It underscores how individual actors with technical skills can compromise national infrastructure, prompting questions about preventive measures for personnel with system access and technical training.