Former Army Soldier Sentenced for Telecom Hacks: SSH Credential Abuse and SIM-Swap Risks

The sentencing is the headline. For Windows admins, security teams and anyone who still relies on SMS for account security, the more useful part is how the operation worked.

The case at a glance​

According to court documents cited by the DOJ, between April 2023 and Dec. 18, 2024, Wagenius used online accounts associated with the nickname "kiberphant0m" and conspired with others to defraud at least 10 victim organizations by obtaining login credentials for the organizations' protected computer networks. This activity happened while Wagenius was on active duty with the U.S. Army.

BleepingComputer's headline describes the victims as "10 tech, telecom firms." The DOJ's wording is narrower: "at least 10 victim organizations." It doesn't say every victim was a tech or telecom company, and it doesn't name them. Reporting from Commondefense, drawing on the DOJ, says the targets included telecommunications companies in the United States and abroad.

A few corrections to the early reporting:

• Age: BleepingComputer gave his age as 21. The DOJ release says 22.
• Plea dates: BleepingComputer said he pleaded guilty in February 2025. The DOJ says he entered guilty pleas on two dates, both in the Western District of Washington:
  • March 5, 2025: two counts of unlawful transfer of confidential phone records information, in a separate case.
  • July 15, 2025: conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft.
• Name: Some outlets gave his middle name as "James." The DOJ uses Cameron John Wagenius.

Section summary: 70 months in prison, $294,978 in restitution, at least 10 victim organizations, and roughly 20 months of activity while he was on active duty.

How the operation worked​

The DOJ's description reads like a textbook intrusion playbook. There was no zero-day in it.

1. Getting credentials. Wagenius and his co-conspirators obtained login credentials using SSH Brute, a hacking tool he helped develop, "among other means," according to the DOJ. The department didn't describe how SSH Brute works, and we won't guess beyond its name.
2. Sharing and planning. The group used Telegram group chats to pass stolen credentials around and discuss breaking into victim networks.
3. Stealing data. With the credentials, they got into protected networks and took data. Commondefense reports the group gained access to data that included phone call logs.
4. Extortion. After data was stolen, Wagenius and his conspirators extorted the victim organizations both privately and in public forums. The extortion attempts included threats to post the stolen data on cybercrime forums such as BreachForums and XSS.is.
5. Selling the data and further fraud. The DOJ says conspirators also offered stolen data for sale on those forums for thousands of dollars. They sold at least some of it and used some to commit other fraud, including SIM-swapping.

Prosecutors say the group tried to extort at least $1 million in total. That's the amount they demanded, not the amount paid. The $294,978 restitution order is a separate figure.

Section summary: This was credential abuse plus the cybercrime marketplace. Stolen logins opened the doors, and forums and Telegram turned the stolen data into money and threats.

Call records of officials, and a threat to the government​

One part of the case explains why it drew so much attention. The DOJ says that in November 2024, Wagenius made two online posts that disclosed stolen confidential non-content call detail records belonging to a government official and family members of another former official and threatened to release additional confidential records unless paid a ransom. The department also says the wording of one post suggested he wanted revenge for the recent arrest of another cybercriminal.

"Non-content" matters here. These records show who called whom and when, not what was said. That metadata can still be very sensitive.

Nextgov reports that the case drew attention following his December 2024 arrest, when cybersecurity journalist Brian Krebs reported that Wagenius was behind an account that posted what it claimed were AT&T call logs associated with then-President-elect Donald Trump and Vice President Kamala Harris. Those were the account's claims as Krebs reported them. The DOJ release doesn't name the officials.

The DOJ also made a claim that deserves a careful read. Assistant Attorney General A. Tysen Duva said Wagenius "even sought to traffic stolen information to a foreign intelligence service." The release gives no more detail about what the information was, which service was involved, or what happened.

What other reporting adds​

Brian Krebs has followed kiberphant0m longer than most, and his sentencing report adds scale the DOJ release doesn't. Krebs describes Wagenius as a U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024. That figure comes from Krebs, not the DOJ release.

Krebs also reports that federal prosecutors said Wagenius was assisted in his efforts to extort victim companies by Kenneth Schuchman, a 28-year old man from Vancouver, Washington who has a lengthy cybercriminal history.

BleepingComputer links Wagenius to Connor Riley Moucka and John Erin Binns. Both were accused in November 2024 of stealing data from more than 165 organizations that used Snowflake's cloud platform. BleepingComputer reports that Moucka pleaded guilty to his role in the Snowflake campaign in August 2026. CyberScoop's coverage also connects Wagenius to attacks involving AT&T and Snowflake.

The DOJ sentencing release doesn't name any co-conspirators. Treat these links as the publications' reporting, not as findings in the sentencing announcement.

On the investigation, the FBI's Brett Leatherman said the FBI, the Defense Criminal Investigative Service (DCIS) and the Army identified and arrested Wagenius within weeks of his extortion threats. The FBI and DCIS led the case. The DOJ credits the Army's Criminal Investigative Division, the U.S. Attorney's Office for the Western District of Texas and the National Security Cyber Section with help.

Why this matters to Windows admins and IT teams​

This section is WindowsForum analysis based on general industry practice. The DOJ didn't recommend specific controls, and nothing in the record shows that any single measure would have stopped these intrusions.

The uncomfortable point is that none of this needed advanced tools. It needed working credentials and somewhere to sell the results. That's why it's relevant to ordinary Windows and hybrid environments:

• SSH isn't only a Linux issue. Windows Server and Windows 11 can run the built-in OpenSSH Server, and many admins turn it on for automation or remote management. If your server allows password logins over SSH, it's open to password-guessing attacks. The usual hardening steps:
  • Use key-based login.
  • Set PasswordAuthentication no in sshd_config, which on Windows is normally at C:\ProgramData\ssh\sshd_config.
  • Limit which IP addresses can reach the port.
  • Watch for repeated failed logins.
• Credentials are the perimeter. The data sat on "protected" networks, and valid logins got the group in. Multifactor authentication for every remote and admin login, conditional access, and removing unused service accounts all make stolen passwords much less useful.
• Watch for bulk downloads. Call records and customer databases are exactly what extortion crews want. Alerts for unusually large queries or exports give defenders a chance to act before a ransom note arrives.
• Keep incident response ready to go. This group ran private extortion and public forum posts at the same time. If you don't already have legal, communications and law-enforcement contacts agreed in advance, you'll be improvising at 2 a.m.

For individual users, the SIM-swapping detail is the one to act on. Once attackers take over your phone number, texted login codes go to them. Use an authenticator app or passkeys wherever a service offers them, and set a port-out PIN or account lock with your mobile carrier.

The bigger picture​

Is 70 months enough? Opinions will differ. Prosecutors framed it as deterrence. First Assistant U.S. Attorney Charles Neil Floyd said Wagenius's schemes "were not only aimed at getting rich, he was also motivated by a desire to achieve status within criminal hacking communities." That's the prosecution's characterization, not a court finding.

The status-seeking point matters for defenders because young, forum-driven crews often care less about staying hidden and more about getting noticed. That makes them loud and quick to escalate.

The good news is that the loudness helped. Investigators found an active-duty soldier within weeks of his public threats. The bad news is that the stolen credentials, the forums and the Telegram chats that made his operation possible haven't gone anywhere, and your organization's own exposed logins are the part you can actually control.

Bottom line: A former soldier is going to prison over an operation built on stolen logins, Telegram coordination and extortion on cybercrime forums. Enforce MFA, turn off password logins for SSH and other remote access, and stop relying on text-message codes to protect important accounts.