[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRjbURvAwQ8tByAFy37kfJGYt9-XNmXKQ9V3I2SvjG98":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":35},"a4c4f776-fb68-495a-b23a-8b69219f5968","U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions","u-s-soldier-gets-70-months-in-prison-for-at-t-verizon-extortions-5569bc","A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.","A U.S. Army soldier, Cameron Wagenius, also known as 'Kiberphant0m,' has been sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution for hacking into telecommunications companies. He stole call and text metadata for over 100 million AT&T customers and extorted companies, even threatening to release national security secrets. Wagenius was stationed in South Korea and worked with alleged co-conspirators, including Kenneth Schuchman, who has a history of cybercrime.","US soldier sentenced to 70 months for hacking AT&T and Verizon.","https:\u002F\u002Fkrebsonsecurity.com\u002F2026\u002F09\u002Fu-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions\u002F",null,"2026-09-25T21:44:40+00:00","2026-09-25T22:00:43.358964+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Kiberphant0m","threat_actor",{"name":21,"type":19},"Cameron John Wagenius",{"name":23,"type":19},"Kenneth Schuchman",{"name":25,"type":19},"Conor Riley Moucka",{"name":27,"type":19},"John Erin Binns",{"name":29,"type":30},"AT&T","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":12,"name":33,"slug":34},"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":31,"icon":12,"name":33,"slug":34},{"category":44},{"id":45,"icon":12,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":12,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"malware","Satori botnet","Operated by co-conspirator Kenneth Schuchman",[29],{"controls":60,"vendors":144},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":91,"name":92,"problem":93,"products":94},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[95,102,110],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":91,"product_name":99,"url":100,"description":101},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"slug":119,"name":120,"problem":121,"products":122},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[123,128,136],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":124,"product_name":125,"url":126,"description":127},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":162},"insider-threat-soldier-exploits-telecom-access-to-steal-100m-customer-records","Insider Threat: Soldier Exploits Telecom Access to Steal 100M Customer Records","Cameron Wagenius, a U.S. Army soldier with privileged access to sensitive systems, leveraged his position and technical knowledge to infiltrate major telecommunications providers and steal metadata belonging to over 100 million customers. This case highlights the severe risks posed by insider threats, particularly when individuals with security clearances or technical roles engage in malicious activity outside their sanctioned duties. The ability to exfiltrate massive datasets and then weaponize them through extortion — including threats to expose national security secrets — underscores the catastrophic consequences of inadequate insider threat monitoring and overly broad data access privileges. Organizations must never assume that trusted employees, contractors, or affiliated personnel are immune to becoming threat actors.",[150,151,152,153,154,155,156,157,158,159,160,161],"CIS Control 3: Data Protection","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 PS-7: External Personnel Security","NIST SP 800-53 SI-4: System Monitoring","NIST Insider Threat Guide (SP 800-82)","GDPR Article 5(1)(c): Data Minimization","GDPR Article 32: Security of Processing","ITIL Service Transition: Change and Access Management",{}]