Former US Soldier Gets 70 Months for Cyber Extortion Scheme

A former US Army soldier has received a 70-month prison sentence for hacking and extorting technology and telecommunications companies. The soldier cyber extortion case involved at least 10 US businesses and ransom demands totalling at least $1 million.

Cameron John Wagenius, 21, must also pay $294,978 in restitution. His criminal activity ran from April 2023 to December 2024, including time when he served on active duty.

Wagenius Pleaded Guilty After December Arrest

Authorities arrested Wagenius in Texas in December 2024. He used the online aliases “kiberphant0m” and “cyb3rph4nt0m.”

In February 2025, he pleaded guilty to two counts of unlawfully transferring confidential phone records in a case involving AT&T and Verizon.

He subsequently pleaded guilty in July 2025 to aggravated identity theft, conspiracy to commit wire fraud and extortion related to computer fraud.

The sentence follows his involvement in stealing sensitive customer information and threatening to release it unless companies paid.

Attackers Stole Credentials and Threatened Data Leaks

According to court documents, Wagenius helped develop a hacking tool called SSH Brute. He and his accomplices used it to steal login credentials for targeted networks.

They also exchanged stolen credentials and coordinated attacks through Telegram.

After obtaining data, the group approached victims with private extortion demands. Meanwhile, they used cybercrime forums to threaten public leaks or advertise stolen information for sale.

The Justice Department identified BreachForums and XSS.is among the forums involved.

In some instances, the attackers offered datasets for thousands of dollars. They successfully sold some information and also used stolen data to support other crimes, including SIM swapping.

Altogether, the group attempted to extort at least $1 million. That figure represents demands rather than confirmed payments.

Soldier Cyber Extortion Case Links to Snowflake Suspects

Two accomplices named in the report, Connor Riley Moucka and John Erin Binns, also faced accusations connected to the Snowflake data theft campaign.

In November 2024, authorities accused them of stealing terabytes of information from more than 165 organizations using Snowflake’s services.

The attackers allegedly demanded payment in exchange for deleting stolen data and withholding it from public release.

Canadian authorities arrested Moucka on October 30, 2024, at the United States’ request. He later pleaded guilty to his role in the campaign in August 2026.

Wider Campaign Affected Major Organizations

Breaches linked to the Snowflake attacks affected hundreds of millions of people. Victim organizations included AT&T, Ticketmaster, Santander and Los Angeles Unified School District.

Other affected businesses included QuoteWizard/LendingTree, Pure Storage, Advance Auto Parts and Neiman Marcus.

Following the incidents, Snowflake announced plans to enforce multifactor authentication. It also said customers would need passwords containing at least 14 characters.