U.S. Soldier Sentenced for Hacking AT&T and Verizon
Army private extorted telecom giants after stealing metadata of 100M customers.
1Military insider cybercrime
Cameron Wagenius, a 22-year-old U.S. Army soldier stationed in South Korea, operated as hacker 'Kiberphant0m' while holding secret clearance. His group exploited unsecured Snowflake cloud accounts lacking multi-factor authentication to steal call/text metadata from AT&T and Verizon. The breach affected over 100 million customers, exposing source/destination numbers, timestamps, and call durations. This marks a rare case of active-duty military personnel engaging in large-scale cyber extortion.
2Extortion tactics revealed
The hacker demanded ransom payments from telecom companies, threatening to publish stolen data. AT&T paid $370,000 in Bitcoin after initial demands. Kiberphant0m later leaked what he claimed were call logs of then President-elect Trump and VP Harris, plus alleged NSA schematics. Despite these high-profile targets, the group only netted $1,500 from data sales. Prosecutors emphasized the psychological and reputational damage outweighed financial gains.
3Global telecom targeting
Beyond AT&T, the group hacked Verizon's Push-to-Talk business and over a dozen international carriers. They specifically sought companies using Snowflake with exposed credentials. The timing coincided with Snowflake's subsequent MFA mandate for all accounts. Co-conspirators included a botnet operator and a suspect in T-Mobile's 2021 breach of 76M records. This pattern shows professionalization of telecom-focused cybercrime rings.
4Unusual military dimension
The Defense Criminal Investigative Service treated this as a critical insider threat case. Wagenius' security clearance and military IT training raised unique risks. Investigators from FBI, Army CID, and Secret Service collaborated due to national security implications. The soldier's position enabled access to sensitive systems while his overseas posting complicated detection - a scenario agencies rarely encounter.
5Prison hacking attempts
While awaiting sentencing, Wagenius violated prison computer policies by researching Windows 10 exploits and D-Link vulnerabilities (CVE-2023-45208) via smuggled AI queries. He framed requests as book research, demonstrating advanced 'prompt injection' techniques. Though no evidence shows he exploited prison systems, these attempts revealed ongoing criminal mindset despite cooperation with prosecutors.
6Legal consequences
Wagenius received 70 months (nearly 6 years) in federal prison plus $294,978 restitution. His immediate guilty plea and cooperation reduced potential sentence. Two accomplices face separate charges, including a T-Mobile breach suspect now in Turkey. The case sets precedent for military cybercrime sentencing, especially involving cleared personnel abusing privileged access.
7Security failures exposed
The breaches revealed critical gaps: telecom reliance on single-factor authentication, Snowflake's delayed MFA enforcement, and military oversight of personnel with hacking skills. Attackers specifically targeted companies with known credential exposure. This case accelerated industry-wide adoption of stricter access controls and monitoring of privileged users in both corporate and government systems.
8New era of insider threats
This incident highlights evolving risks from technically skilled insiders, especially in military-telecom intersections. The combination of stolen credentials, extortion tactics, and attempted prison hacking demonstrates persistent cybercriminal behavior. It prompts reevaluation of security clearances for personnel with demonstrated hacking capabilities and closer monitoring of military access to commercial systems.
Original article: Krebs on Security — U.S. Soldier Sentenced for Hacking AT&T and Verizon