https://krebsonsecurity.com/2024/12/u-s-army-soldier-arrested-in-att-verizon-extortions/ Advertisement [1] Advertisement [10] Krebs on Security Skip to content * Home * About the Author * Advertising/Speaking U.S. Army Soldier Arrested in AT&T, Verizon Extortions December 30, 2024 22 Comments Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South Korea. [camwagenius-selfie] One of several selfies on the Facebook page of Cameron Wagenius. Cameron John Wagenius was arrested near the Army base in Fort Hood, Texas on Dec. 20, after being indicted on two criminal counts of unlawful transfer of confidential phone records. The sparse, two-page indictment (PDF) doesn't reference specific victims or hacking activity, nor does it include any personal details about the accused. But a conversation with Wagenius' mother -- Minnesota native Alicia Roen -- filled in the gaps. Roen said that prior to her son's arrest he'd acknowledged being associated with Connor Riley Moucka, a.k.a. "Judische," a prolific cybercriminal from Canada who was arrested in late October for stealing data from and extorting dozens of companies that stored data at the cloud service Snowflake. In an interview with KrebsOnSecurity, Judische said he had no interest in selling the data he'd stolen from Snowflake customers and telecom providers, and that he preferred to outsource that to Kiberphant0m and others. Meanwhile, Kiberphant0m claimed in posts on Telegram that he was responsible for hacking into at least 15 telecommunications firms, including AT&T and Verizon. On November 26, KrebsOnSecurity published a story that followed a trail of clues left behind by Kiberphantom indicating he was a U.S. Army soldier stationed in South Korea. Ms. Roen said Cameron worked on radio signals and network communications at an Army base in South Korea for the past two years, returning to the United States periodically. She said Cameron was always good with computers, but that she had no idea he might have been involved in criminal hacking. "I never was aware he was into hacking," Roen said. "It was definitely a shock to me when we found this stuff out." Ms. Roen said Cameron joined the Army as soon as he was of age, following in his older brother's footsteps. "He and his brother when they were like 6 and 7 years old would ask for MREs from other countries," she recalled, referring to military-issued "meals ready to eat" food rations. "They both always wanted to be in the Army. I'm not sure where things went wrong." Immediately after news broke of Moucka's arrest, Kiberphant0m posted on the hacker community BreachForums what they claimed were the AT&T call logs for President-elect Donald J. Trump and for Vice President Kamala Harris. "In the event you do not reach out to us @ATNT all presidential government call logs will be leaked," Kiberphant0m threatened, signing their post with multiple "#FREEWAIFU" tags. "You don't think we don't have plans in the event of an arrest? Think again." [kiberphant0m-nsa-schema] Kiberphant0m posting what he claimed was a "data schema" stolen from the NSA via AT&T. On that same day, Kiberphant0m posted what they claimed was the "data schema" from the U.S. National Security Agency. On Nov. 5, Kiberphant0m offered call logs stolen from Verizon's push-to-talk (PTT) customers -- mainly U.S. government agencies and emergency first responders. On Nov. 9, Kiberphant0m posted a sales thread on BreachForums offering a "SIM-swapping" service targeting Verizon PTT customers. In a SIM-swap, fraudsters use credentials that are phished or stolen from mobile phone company employees to divert a target's phone calls and text messages to a device they control. The profile photo on Wagenius' Facebook page was deleted within hours of my Nov. 26 story identifying Kiberphant0m as a likely U.S. Army soldier. Still, many of his original profile photos remain, including several that show Wagenius in uniform while holding various Army-issued weapons. [wagenius-fb] Several profile photos visible on the Facebook page of Cameron Wagenius. November's story on Kiberphant0m cited his own Telegram messages saying he maintained a large botnet that was used for distributed denial-of-service (DDoS) attacks to knock websites, users and networks offline. In 2023, Kiberphant0m sold remote access credentials for a major U.S. defense contractor. Allison Nixon, chief research officer at the New York-based cybersecurity firm Unit 221B, helped track down Kiberphant0m's real life identity. Nixon was among several security researchers who faced harassment and specific threats of violence from Judische and his associates. "Anonymously extorting the President and VP as a member of the military is a bad idea, but it's an even worse idea to harass people who specialize in de-anonymizing cybercriminals," Nixon told KrebsOnSecurity. She said the investigation into Kiberphant0m shows that law enforcement is getting better and faster at going after cybercriminals -- especially those who are actually living in the United States. "Between when we, and an anonymous colleague, found his opsec mistake on November 10th to his last Telegram activity on December 6, law enforcement set the speed record for the fastest turnaround time for an American federal cyber case that I have witnessed in my career," she said. Nixon asked to share a message for all the other Kiberphant0ms out there who think they can't be found and arrested. "I know that young people involved in cybercrime will read these articles," Nixon said. "You need to stop doing stupid shit and get a lawyer. Law enforcement wants to put all of you in prison for a long time." The indictment against Wagenius was filed in Texas, but the case has been transferred to the U.S. District Court for the Western District of Washington in Seattle. This entry was posted on Monday 30th of December 2024 11:05 PM A Little Sunshine Ne'er-Do-Well News Allison Nixon Cameron John Wagenius Connor Riley Moucka Judische Kiberphant0m Unit 221B Post navigation - Happy 15th Anniversary, KrebsOnSecurity! 22 thoughts on "U.S. Army Soldier Arrested in AT&T, Verizon Extortions" 1. Brad Larkin December 30, 2024 Nice job Brian. Thank you on behalf of all Americans. FWIW, the DEI crowd renamed Fort Hood to be Fort Cavazos. Uniform Code of Military Justice SS915. Art. 115. Communicating threats (a) Communicating Threats Generally.-Any person subject to this chapter who wrongfully communicates a threat to injure the person, property, or reputation of another shall be punished as a court-martial may direct. Reply - 1. Joe December 30, 2024 Has nothing to do with DEI. "Cavazos was the first Hispanic American to earn the rank of four-star general in the U.S. Army. He served as the commander of Fort Hood and III Corps from 1980 to 1982. He also served in the Korean War and Vietnam." Are saying that naming a base after a Vietnam vet is worse than naming it after a Confederate general? Reply - 1. Wannabe Techguy December 31, 2024 Nothing wrong with a Confederate general. Reply - 1. hick December 31, 2024 plenty wrong with treason and mutiny. On top of that, they lost the war Reply - 1. maikal December 31, 2024 Exactly! Gone are the day we honor traitors! Despite Trumpostinking who has threatened to change the names again! But he is only there for 4 years! We'll change them back! Reply - 2. Preisschild December 31, 2024 > Nothing wrong with a Confederate general. Besides them being traitors and fighting for the right to keep slaves? Reply - 2. huh December 31, 2024 I thought they renamed it because Fort Hood was getting so many scandals that they needed to rebrand Reply - 2. Joe December 30, 2024 Fort Hood has been renamed some time ago to Fort Cavazos. Reply - 3. Dennis December 31, 2024 Wow. Was this guy that dumb? Anyone residing in a Western country and doing this shady stuff is a walking perp. It's just the matter of time before he gets caught. And blackmailing the president on top of that, while serving in the military is the next level dumb. When will they learn? You need to move to Russia or to North Korea to get away with all that. Reply - 1. jacob December 31, 2024 His mother being an open book speaks for itself lel Reply - 1. Quid December 31, 2024 TIL LEL Reply - 2. Alicia Roen December 31, 2024 I am his mother and I am not an open book, I was asked general questions about my sons age and if he was a solider! That is all I said and Krebs already had this information. I never knew my son was involved in any of this or involved with others until I read Krebs 1st article following my sons arrest, which was all new news to me! Do you really think a child would ever tell his parents he was involved in criminal activity? Reply - 4. notCreb December 31, 2024 Nice detrace from kyber Reply - 5. Darren Mott December 31, 2024 This incident underscores the need for robust internal security measures to prevent insider threats. At GoldShield Cyber, we specialize in protecting businesses from both external and internal cybersecurity risks. Reply - 1. zerotwo from lapsus December 31, 2024 While robust internal security measures are indeed important for preventing insider threats, it's essential to recognize that a comprehensive cybersecurity strategy goes beyond just focusing on insider risks. A disproportionate emphasis on internal threats might divert resources from addressing equally critical external vulnerabilities, such as sophisticated phishing attacks, ransomware, and supply chain compromises. - Dritan Reply - 6. Pa December 31, 2024 At very frequent intervals we read of a big company - here AT&T and Verizon - which should have enough money and common sense to staff a competent cyber-defense department being cyber-ransacked by hackers. This drum-roll of corporate cyber-bungling goes on and on. Is there no hope of change ? Reply - 1. Wannabe Techguy December 31, 2024 No, no hope of change. They don't care about their customers. When major corporations have a breach, what happens to them? Nothing. Reply - 2. Phil December 31, 2024 Apparently you've never had to work with AT&T support services. Reply - 7. Quid December 31, 2024 TIL LEL Reply - 8. a December 31, 2024 the punishment for treason is death Reply - 9. P80 Systems BBS December 31, 2024 It's obvious that "kiberphantom" had a James-bond-ease visions for himself. When I was a teenager decades ago, I had same grandiose hacking ambitions. He clearly was an amateur and a young idiot. I don't condone hacking anymore but if you spend a lot of time talking game, you're eventually going to get caught due to your ego. Reply - 10. Vet December 31, 2024 Have fun at Ft. Leavenworth! Reply - Leave a Reply Cancel reply Your email address will not be published. Required fields are marked * [ ] [ ] [ ] [ ] [ ] [ ] [ ] Comment * [ ] Name * [ ] Email * [ ] Website [ ] [Post Comment] [ ] [ ] [ ] [ ] [ ] [ ] [ ] D[ ] Advertisement [3] Advertisement Mailing List Subscribe here Search KrebsOnSecurity Search for: [ ] [Search] Recent Posts * U.S. Army Soldier Arrested in AT&T, Verizon Extortions * Happy 15th Anniversary, KrebsOnSecurity! * Web Hacking Service 'Araneida' Tied to Turkish IT Firm * How to Lose a Fortune with Just One Bad Click * How Cryptocurrency Turns to Cash in Russian Banks Story Categories * A Little Sunshine * All About Skimmers * Ashley Madison breach * Breadcrumbs * Data Breaches * DDoS-for-Hire * Employment Fraud * How to Break Into Security * Internet of Things (IoT) * Latest Warnings * Ne'er-Do-Well News * Other * Pharma Wars * Ransomware * Russia's War on Ukraine * Security Tools * SIM Swapping * Spam Nation * Target: Small Businesses * Tax Refund Fraud * The Coming Storm * Time to Patch * Web Fraud 2.0 Why So Many Top Hackers Hail from Russia [computered-580x389] (c) Krebs on Security - Mastodon