Cameron John Wagenius, 22, received 5.8 years (70 months) in prison and also must pay $294,978 in restitution at his sentencing in federal court Friday, September 25.
In November 2024, Wagenius made two online posts that disclosed stolen confidential non-content call detail records belonging to a government official and family members of another former official and threatened to release additional confidential records unless paid a ransom, according to court records.
“Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “He targeted U.S. and foreign telecommunications companies, compromised the sensitive data of countless people, and even sought to traffic stolen information to a foreign intelligence service. His actions reflect an alarming disregard for the security of the public and the United States.”
“Mr. Wagenius engaged in a long spree of criminal conduct attempting to blackmail hacking victims for more than $1 million. He has repeatedly shown disregard for the privacy and security of others, the rules of the military, and the law,” said First Assistant U.S. Attorney Charles Neil Floyd for the Western District of Washington. “His hacking schemes were not only aimed at getting rich, he was also motivated by a desire to achieve status within criminal hacking communities.”
Obtained Logins
Between April 2023 and Dec. 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations by obtaining login credentials for the organizations’ protected computer networks, according to court records.
Wagenius and his conspirators obtained these credentials using a hacking tool that Wagenius helped develop called SSH Brute, among other means. They used Telegram group chats to transfer stolen credentials and discuss gaining unauthorized access to victim companies’ networks. This activity happened while Wagenius was on active duty with the U.S. Army.
After stealing the data, Wagenius and his conspirators extorted the victim organizations privately and in public forums.
The extortion attempts included threats to post the stolen data on cybercrime forums such as BreachForums and XSS.is. In other instances, conspirators offered to sell stolen data for thousands of dollars via posts on these forums. They successfully sold at least some of this stolen data and also used stolen data to perpetuate other frauds, including SIM-swapping.
Stole $1 Million
In total, Wagenius and his co-conspirators attempted to extort at least $1 million from victim data owners.
Wagenius pleaded guilty in the Western District of Washington to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft on July 15, 2025.
He also pleaded guilty in a separate case also in the Western District of Washington to two counts of unlawful transfer of confidential phone records information in connection with this conspiracy on March 5, 2025.