Arrest of US Army Soldier Tied to AT&T and Verizon Extortion

Federal authorities arrested a serving member of the U.S. military for a two-count indictment reportedly tied to the breach of Snowflake customer accounts and follow-on extortion.

See Also: 2024 Threat Hunting Report: Insights to Outsmart Modern Adversaries

Police detained Cameron John Wagenius, 20, on Dec. 20 near the U.S. Army’s military base Fort Cavazos, formerly known as Fort Hood, in Texas, as cybersecurity blogger Brian Krebs first reported.

A two-count indictment against Wagenius, filed under seal on Dec. 18 in Seattle federal court, charges him with “knowingly and intentionally” selling and transferring “confidential phone records information,” without first obtaining “prior authorization from the customer to whom such confidential phone records information related” to do so, as well as “having reason to know such information was obtained fraudulently.”

The court unsealed the indictment Monday.

The indictment makes no mention of the cloud-based data warehousing platform Snowflake. Wagenius’ mother told Krebs that her son confirmed to her that he’d been associating with Connor Riley Moucka – aka “Judische,” “Waifu” – and that her son was stationed at a U.S. military base in South Korea for the past two years, making periodic visits back to the U.S.

Federal prosecutors declined to comment about any alleged connection between Wagenius and the theft of data from customers of Bozeman, Minnesota-based Snowflake, including AT&T and Verizon.

A U.S. indictment unsealed last month charges Moucka and American John Binns with stealing terabytes of data from cloud platform Snowflake in a major breach impacting over 165 organizations and involving roughly 50 billion call and text records, as well as extorting “at least 36 bitcoin” – worth $3.4 million as of Tuesday – from victims.

At least 10 organizations whose Snowflake data got swiped received ransom demands ranging from $300,000 to $5 million in return for a promise to not leak stolen data, said incident response firm Mandiant, which Snowflake hired to probe the attacks for.

At least one victim, AT&T, paid the attackers a ransom worth $370,000 in return for a promise to delete stolen data pertaining to 110 million AT&T cellphone plan customers, corroborated by a video showing the attacker doing so, reported Wired.

Canadian police arrested Moucka last month. Turkish police arrested Binns in May on separate charges tied to a 2022 U.S. 12-count indictment accusing him of hacking T-Mobile in 2021.

The U.S. is seeking both suspects’ extradition.

Snowflake attackers successfully accessed accounts for which customers hadn’t enabled multifactor authentication. The cloud provider subsequently implemented a range of security improvements, including mandatory multifactor for new accounts, giving administrators the ability to make MFA mandatory for all users, and regularly nudging for established accounts that hadn’t yet activated MFA (see: After Customers Get Breached, Snowflake Refines Security).

Last month, Krebs reported that investigators believe Judische tasked someone going by the online handle “Kiberphant0m” with selling data from Snowflake victims who refused to pay a ransom. Krebs cited security researchers’ evidence that Kiberphant0m appeared to be a U.S. soldier who’d been stationed in South Korea.

Kiberphant0m has been a regular poster to the cybercriminal site Breach Forums. In January, he solicited for $3,000 the source code for an “advanced Linux botnet” called Mushi that could be used to generate denial-of-service attacks. He offered to sell “big data belonging to the FBI” in May and offered 900 gigabytes of data allegedly stolen from a Thai telecommunications firm in June. On Oct. 14, he offered for sale 328 gigabytes of data stolen from Verizon, including API access credentials, credentials for F5 networking gear, SIM keys and more. The selling price was $200,000. On Nov. 9, Kiberphant0m advertised “SIM swapping services” targeting push-to-talk Verizon customers, “to those who have high valuable targets (pref crypto).”

Following Moucka’s arrest, on Nov. 7 Kiberphant0m responded by threatening AT&T, leaking to Breach Forums what they claimed were “call logs” for both U.S. presidential contenders Kamala Harris and Donald Trump, and threatening to leak further such data unless AT&T reached out via Telegram, in a post sporting multiple “#FREEWAIFU” hashtags.

“You don’t think we don’t have plans in the event of an arrest?” Kiberphant0m posted. “Think again.”