U.S. Army soldier Cameron John Wagenius, 20, has been arrested and charged with unlawfully transferring confidential phone records.
Federal authorities accuse the young soldier of participating in a cybercriminal ring that sold sensitive data, including alleged phone records of President-elect Donald Trump and Kamala Harris, on the black market.
The indictment, unsealed this week, reveals two counts of unlawful transfer of confidential phone records filed against Wagenius, according to KrebsonSecurity.
The charges follow a December 20 arrest near Fort Hood, Texas, a base associated with Fort Cavazos where Wagenius was stationed.
Wagenius, described by his mother as a tech-savvy soldier, worked on network communications at an Army base in South Korea before returning stateside.
His mother, Alicia Roen, told cybersecurity journalist Brian Krebs, “I never was aware he was into hacking. It was definitely a shock to me when we found this stuff out.”
In a comment to Krebs website, Mrs. Roen wrote, “I am his mother and I am not an open book, I was asked general questions about my sons age and if he was a solider! That is all I said and Krebs already had this information. I never knew my son was involved in any of this or involved with others until I read Krebs 1st article following my sons arrest, which was all new news to me! Do you really think a child would ever tell his parents he was involved in criminal activity?”
Operating under the online alias “Kiberphant0m,” Wagenius is accused of participating in multiple high-profile data breaches. He allegedly sold confidential phone records on online forums in November, claiming to have hacked 15 telecommunications firms, including AT&T and Verizon.
In November, “Kiberphant0m” posted what were purported to be AT&T call logs for President-elect Trump and Vice President Harris, though the authenticity of these records has not been confirmed.
The arrest follows an investigation into a series of data breaches affecting numerous organizations. Wagenius’s alleged accomplices include Canadian national Connor Riley Moucka, known online as “Judische,” who was arrested in late October, and John Binns, currently detained in Turkey.
These individuals are suspected of involvement in the theft and extortion of data from customers of the cloud service Snowflake, among other targets.
Allison Nixon, chief research officer at the New York-based cybersecurity firm Unit 221B, helped track down Kiberphant0m’s real life identity. Nixon was among several security researchers who faced harassment and specific threats of violence from Judische and his associates.
“Anonymously extorting the President and VP as a member of the military is a bad idea, but it’s an even worse idea to harass people who specialize in de-anonymizing cybercriminals,” Nixon told KrebsOnSecurity. She said the investigation into Kiberphant0m shows that law enforcement is getting better and faster at going after cybercriminals — especially those who are actually living in the United States.
“Between when we, and an anonymous colleague, found his opsec mistake on November 10th to his last Telegram activity on December 6, law enforcement set the speed record for the fastest turnaround time for an American federal cyber case that I have witnessed in my career,” she said.
Nixon asked to share a message for all the other Kiberphant0ms out there who think they can’t be found and arrested.
“I know that young people involved in cybercrime will read these articles,” Nixon said. “You need to stop doing stupid shit and get a lawyer. Law enforcement wants to put all of you in prison for a long time.”
The indictment against Wagenius was filed in Texas, but the case has been transferred to the U.S. District Court for the Western District of Washington in Seattle.