[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz_YOEgO1uk3R5BJ8Bj9wcqEIJ1zaDLAznD8h5I3IXTw":3},{"article":4,"iocs":55,"watch_terms":59,"solutions":60,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b7e1d691-1aad-4330-80f3-cdb7aea9e5f1","Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies","army-soldier-sentenced-for-spree-of-attacks-on-at-t-snowflake-and-other-major-co-febe8c","Cameron Wagenius was involved in some of the most high-profile attacks of 2024 while on active duty. The post Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies appeared first on CyberScoop.","A former Army soldier, Cameron Wagenius, has been sentenced to 70 months in prison for a wide-ranging cybercrime spree that included attacks on AT&T and Snowflake. While on active duty, Wagenius engaged in extortion attempts, stole sensitive data, and even attempted to sell stolen information to a foreign intelligence service. He was also involved in the massive Snowflake customer environment compromise in 2024.","Army soldier sentenced to 70 months for cybercrime spree targeting AT&T and Snowflake.","https:\u002F\u002Fcyberscoop.com\u002Fcameron-wagenius-att-snowflake-attacks-sentenced\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F09\u002FGettyImages-2169763675.jpg","2026-09-25T21:28:36+00:00","2026-09-25T22:00:36.458993+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Cameron Wagenius","threat_actor",{"name":21,"type":22},"Snowflake","product",{"name":24,"type":25},"AT&T","vendor",{"name":27,"type":19},"Connor Moucka",{"name":29,"type":19},"John Erin Binns",{"name":31,"type":22},"SSH Brute","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":31,"context":58},"malware","Hacking tool developed and used by Wagenius to steal credentials.",[24,21,31],{"controls":61,"vendors":146},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":92,"name":93,"problem":94,"products":95},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"slug":121,"name":122,"problem":123,"products":124},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":142,"product_name":143,"url":144,"description":145},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":164},"insider-threat-active-duty-soldier-sentenced-for-multi-company-data-breach-spree","Insider Threat: Active-Duty Soldier Sentenced for Multi-Company Data Breach Spree","Cameron Wagenius, while serving as an active-duty Army soldier, exploited privileged access and insider knowledge to steal sensitive data from major companies including AT&T and Snowflake customer environments, then attempted to monetize it through extortion and foreign intelligence sales. This case highlights the devastating impact of insider threats, where trusted individuals abuse their access for personal or financial gain. The Snowflake-related breaches in particular underscore how third-party cloud environments can become attack vectors when customer-side access controls and credential hygiene are insufficient. The willingness to sell stolen data to a foreign intelligence service elevates this beyond financial crime into a national security concern, demonstrating why background monitoring and behavioral analytics for privileged users are critical.",[152,153,154,155,156,157,158,159,160,161,162,163],"CIS Control 5 - Account Management","CIS Control 6 - Access Control Management","CIS Control 13 - Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 PS-7 (External Personnel Security)","NIST SP 800-53 AU-12 (Audit Record Generation)","NIST Insider Threat Guide (SP 800-53 AT-2)","GDPR Article 32 - Security of Processing","GDPR Article 33 - Notification of Personal Data Breach","MITRE ATT&CK T1078 - Valid Accounts","MITRE ATT&CK T1041 - Exfiltration Over C2 Channel",{}]