INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Former U.S. Soldier Sentenced for Hacking and Extortion Scheme

| 2026-09-28 15:23 MEDIUM LOW RANSOMWARE & EXTORTION DATA BREACH LAW ENFORCEMENT
JSON
Executive Summary
AI-generated
A former US Army soldier, Cameron John Wagenius, was sentenced to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies' databases, access sensitive records, and extort the companies by threatening to release stolen data unless ransoms were paid. The attack began on November 2024 when Wagenius made two online posts disclosing stolen confidential non-content call detail records belonging to a government official and family members of another former official, with threats to release additional records unless payment was made. This incident reflects an alarming disregard for the security of the public and the United States, as Wagenius targeted US and foreign telecommunications companies, compromised sensitive data of countless people, and even sought to traffic stolen information to a foreign intelligence service.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
xs•••••.is
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
SoldierSoldier
Target & Sectors
NORTH_AMERICA NORTH_AMERICA governmentgovernment defensedefense telecommunicationstelecommunications
Incident Timeline
‎between April 2023
Threat actors used online accounts associated with the nickname "kiberphant0m" to defraud at least 10 victim organizations by obtaining login credentials for their protected computer networks.
victims 10 victim organizations
According to court documents, between April 2023 and Dec. 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations by obtaining login credentials for the organizations’ protected computer networks.
‎April 2023
Former U.S. Army soldier Wagenius and his co-conspirators used SSH Brute to obtain sensitive data, which they then attempted to extort at least $1 million from victim data owners through cybercrime forums like BreachForums and Telegram group chats.
organisation BreachForums
The extortion attempts included threats to post the stolen data on cybercrime forums such as BreachForums and XSS.is.
organisation SSH Brute
Wagenius and his conspirators obtained these credentials using a hacking tool that Wagenius helped develop called SSH Brute, among other means.
organisation Telegram
They used Telegram group chats to transfer stolen credentials and discuss gaining unauthorized access to victim companies’ networks.
organisation the U.S. Army
This activity happened while Wagenius was on active duty with the U.S. Army.
organisation SIM
They successfully sold at least some of this stolen data and also used stolen data to perpetuate other frauds, including SIM-swapping.
financial $1 conspirators
In total, Wagenius and his co-conspirators attempted to extort at least $1 million from victim data owners.
‎November 2024
Cameron Wagenius, a former U.S. soldier, was arrested and sentenced for hacking into the networks of U.S. telecommunications companies, stealing private records, and extorting victims for over $1 million in November 2024.
industry Government
In November 2024, Wagenius made two online posts that disclosed stolen confidential non-content call detail records belonging to a government official and family members of another former official and threatened to release additional confidential records unless paid a ransom.
organisation Cameron Wagenius
“Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
organisation the Justice Department’s Criminal Division
“Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
organisation Cyber Field Office
Cyber Field Office.
‎Dec. 18, 2024
Threat actors used online accounts associated with the nickname "kiberphant0m" to defraud at least 10 victim organizations by obtaining login credentials for their protected computer networks.
victims 10 victim organizations
According to court documents, between April 2023 and Dec. 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations by obtaining login credentials for the organizations’ protected computer networks.
‎March 5, 2025
The former U.S. soldier, Wagenius, pleaded guilty to multiple charges related to his hacking and extortion scheme on March 5, 2025.
tactic Extortion
Wagenius  pleaded guilty in the Western District of Washington to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft on July 15, 2025, and he pleaded guilty in a separate case also in the Western District of Washington to two counts of unlawful transfer of confidential phone records information in connection with this conspiracy on March 5, 2025.
organisation The U.S. Army’s Criminal Investigative Division
The U.S. Army’s Criminal Investigative Division, the U.S. Attorney’s Office for the Western District of Texas, and the National Security Cyber Section provided valuable assistance.
organisation the National Security Cyber Section
The U.S. Army’s Criminal Investigative Division, the U.S. Attorney’s Office for the Western District of Texas, and the National Security Cyber Section provided valuable assistance.
organisation Trial
Senior Counsel Louisa Becker and Trial Attorney George Brown of the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Sok Tea Jiang for the Western District of Washington prosecuted the case.
organisation the Justice Department’s Computer Crime
Senior Counsel Louisa Becker and Trial Attorney George Brown of the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Sok Tea Jiang for the Western District of Washington prosecuted the case.
organisation IP
Since 2020, CCIPS has secured the conviction of over 180 cyber and IP criminals, and court orders for the return of over $350 million in victim funds.
‎July 15, 2025
A former U.S. soldier, Wagenius, pleaded guilty to conspiracy and extortion charges on July 15, 2025.
tactic Extortion
Wagenius  pleaded guilty in the Western District of Washington to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft on July 15, 2025, and he pleaded guilty in a separate case also in the Western District of Washington to two counts of unlawful transfer of confidential phone records information in connection with this conspiracy on March 5, 2025.
‎September 25
A former U.S. Army soldier was sentenced to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies' databases and extort them through threats of releasing stolen data.
industry Telecommunications
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
organisation U.S. Department of Justice
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
organisation Army
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
financial $294,978 prison
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
‎September 25, 2026
A former U.S. soldier was sentenced for hacking and extortion, exposing sensitive data of a U.S. government official.
‎2026/09/28
A former U.S. Army soldier was sentenced to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies' databases and extort them through threats of releasing stolen data.
industry Telecommunications
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
organisation U.S. Department of Justice
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
organisation Army
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
financial $294,978 prison
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
target_region United States
“Today’s sentencing underscores the relentless efforts to identify, investigate, and prosecute cybercriminals targeting the Department of Defense, the defense industrial base, and American public,” said Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, Defense Criminal Investigative Service (DCIS)
industry Defense
“Today’s sentencing underscores the relentless efforts to identify, investigate, and prosecute cybercriminals targeting the Department of Defense, the defense industrial base, and American public,” said Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, Defense Criminal Investigative Service (DCIS)
organisation the Department of Defense
“Today’s sentencing underscores the relentless efforts to identify, investigate, and prosecute cybercriminals targeting the Department of Defense, the defense industrial base, and American public,” said Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, Defense Criminal Investigative Service (DCIS)
organisation Defense Criminal Investigative Service
“Today’s sentencing underscores the relentless efforts to identify, investigate, and prosecute cybercriminals targeting the Department of Defense, the defense industrial base, and American public,” said Special Agent in Charge Kenneth DeChellis of the Department of Defense Office of Inspector General, Defense Criminal Investigative Service (DCIS)
organisation the Department of Justice’s
Today’s sentence demonstrates the Department of Justice’s commitment to protecting privacy and security.”
Tactical Metrics
Metrics
financial
294,978
Prison
September 25 – U.S. Department of Justice : Cameron John Wagenius , 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the  companies by threatening to release the stolen data unless ransoms were paid.
Metrics
victims
10
Victim Organizations
According to court documents, between April 2023 and Dec. 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations by obtaining login credentials for the organizations’ protected computer networks.
Metrics
financial
1,000,000
Conspirators
In total, Wagenius and his co-conspirators attempted to extort at least $1 million from victim data owners.
Intelligence Sources
Data Breaches 2026-09-28