Full Report
Federal prosecutors accuse Cameron Wagenius of searching how to defect to Russia before he tried to sell stolen data to a foreign intelligence service. The post Army soldier linked to Snowflake attack spree allegedly tried to sell data to foreign spies appeared first on CyberScoop.
Analysis Summary
# Threat Actor: Cameron Wagenius (Insider Threat/Financially Motivated Actor)
## Attribution & Identity
**Primary Identification:** Cameron Wagenius, a 21-year-old U.S. Army soldier.
**Known Aliases:** kiberphant0m, cyb3rph4nt0m (used on online criminal forums).
**Associated Groups:** Alleged affiliation with a group referred to as 'The Com' (noted as an 'online gang culture' that involves a mix of external and insider threats). Alleged co-conspirators include Connor Moucka and John Binns, who were indicted for extortion following data breaches targeting cloud platforms like Snowflake.
## Activity Summary
Wagenius was allegedly involved in a conspiracy to extort victims and leak sensitive information.
* In November, he attempted to extort **$500,000** from a major telecommunications company (identified as AT&T by researchers) while threatening to leak call records of high-ranking public officials.
* He communicated with an email address he believed belonged to a **foreign intelligence service** in an attempt to sell stolen data.
* Authorities allege he had access to thousands of stolen identification documents and large amounts of cryptocurrency.
* He conducted searches related to fleeing the U.S. and defecting, specifically mentioning Russia.
* The data he allegedly possessed was partially obtained during a broader attack spree targeting up to 165 organizations storing data on Snowflake.
## Tactics, Techniques & Procedures
- **Extortion:** Attempted to extort a major telecom company for $500,000.
- **Data Theft/Misuse:** Possessed and attempted to sell stolen sensitive information, including "confidential phone records."
- **Evasion/Obfuscation:** Purchased a new laptop against military order and used **VPN software** to hide identity and location while operating from the barracks.
- **Espionage/Treason Preparation:** Communicated intent to sell data to a foreign intelligence service and researched treason and defection options.
- **Insider Threat:** Exploited his position as an active duty soldier to potentially access information and carry out activities.
- **[No specific MITRE ATT&CK IDs mentioned]**
## Targeting
- **Sectors:** Telecommunications (specifically cited AT&T), organizations storing data on Snowflake.
- **Geography:** Targeting U.S. entities, with the actor being based in the U.S. (Fort Cavazos, Texas) and making attempts to sell data to a foreign entity.
- **Victims:** A major telecommunications company (allegedly AT&T), high-ranking public officials (whose phone records were threatened).
## Tools & Infrastructure
- **Malware Families Used:** Not specified.
- **Infrastructure (C2, domains, IPs):**
- Used an unverified email address believed to belong to a foreign intelligence service for selling data.
- Used a newly acquired laptop protected by **VPN software** post-seizure of initial devices.
## Implications
This case highlights a significant intersection between financially motivated cybercrime and national security threats due to the actor's status as an active military insider. The attempted sale of data to a foreign intelligence service suggests a willingness to transition from cybercrime for profit to espionage, potentially undermining U.S. security interests. The operation underscores the severe risk posed by insider threats with privileged access.
## Mitigations
- Heightened vigilance regarding insider threats, especially within military or sensitive government/corporate roles.
- Strict enforcement of policies regarding the use of personal devices on secure networks (Wagenius purchased a new laptop against orders).
- Enhanced monitoring for use of obfuscation tools like VPNs by personnel accessing sensitive systems.
- Improved security protocols around data exposed via third-party cloud providers like Snowflake, which served as a source for the stolen data.