[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkHPOl1M2TTZLzW81_hDQ-O63Nz0uqJD5RtBfmFL70_A":3},{"article":4,"iocs":53,"watch_terms":62,"solutions":63,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d510ca51-23f3-4037-896c-f78064e72a89","US soldier gets 70 months in prison for extorting 10 tech, telecom firms","us-soldier-gets-70-months-in-prison-for-extorting-10-tech-telecom-firms-55c3c3","A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. [...]","A former U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies. He used a self-developed SSH Brute tool and Telegram to steal credentials, extort companies, and sell stolen data, attempting to extort over $1 million. Wagenius was also ordered to pay over $294,000 in restitution.","US soldier sentenced to 70 months for hacking and extorting tech firms.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fus-soldier-gets-70-months-in-prison-for-extorting-10-tech-telecom-firms\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F28\u002FPrison.jpg","2026-09-28T07:30:15+00:00","2026-09-28T08:00:17.049022+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"Cameron John Wagenius","threat_actor",{"name":21,"type":19},"kiberphant0m",{"name":23,"type":19},"cyb3rph4nt0m",{"name":25,"type":19},"Connor Riley Moucka",{"name":27,"type":19},"Waifu",{"name":29,"type":19},"Judische","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"malware","SSH Brute","Tool used by the soldier to steal login credentials.",{"type":59,"value":60,"context":61},"domain","XSS.is","Cybercrime forum where stolen data was threatened to be posted.",[],{"controls":64,"vendors":149},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"slug":95,"name":96,"problem":97,"products":98},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,141],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":137,"product_name":138,"url":139,"description":140},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":167},"ssh-brute-force-attack-leads-to-multi-million-dollar-extortion-scheme","SSH Brute-Force Attack Leads to Multi-Million Dollar Extortion Scheme","A former U.S. Army soldier exploited weak SSH authentication across at least 10 technology and telecom companies, using a self-developed brute-force tool to steal credentials and exfiltrate sensitive data. The root cause was inadequate access control — organizations failed to enforce strong authentication mechanisms, rate limiting, and account lockout policies on externally accessible SSH services. Once inside, the attacker operated undetected long enough to stage an extortion campaign exceeding $1 million in demands, indicating insufficient monitoring and alerting capabilities. This case highlights how a single, well-known attack vector (credential brute-forcing) can cascade into significant financial and reputational damage when basic security hygiene is neglected.",[155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-4: System Monitoring","NIST SP 800-53 AU-6: Audit Record Review and Analysis","MITRE ATT&CK T1110: Brute Force","MITRE ATT&CK T1078: Valid Accounts","GDPR Article 32: Security of Processing (where EU data was involved)",{}]