[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRfR9s75DIh-fV6eUPFfgFyI9XAPWezrju9PgBM452nw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"bf09bee5-b9ad-49c3-a3a3-548b32082882","insider-threat-active-duty-soldier-sentenced-for-multi-company-data-breach-spree","b7e1d691-1aad-4330-80f3-cdb7aea9e5f1","Insider Threat: Active-Duty Soldier Sentenced for Multi-Company Data Breach Spree","Cameron Wagenius, while serving as an active-duty Army soldier, exploited privileged access and insider knowledge to steal sensitive data from major companies including AT&T and Snowflake customer environments, then attempted to monetize it through extortion and foreign intelligence sales. This case highlights the devastating impact of insider threats, where trusted individuals abuse their access for personal or financial gain. The Snowflake-related breaches in particular underscore how third-party cloud environments can become attack vectors when customer-side access controls and credential hygiene are insufficient. The willingness to sell stolen data to a foreign intelligence service elevates this beyond financial crime into a national security concern, demonstrating why background monitoring and behavioral analytics for privileged users are critical.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all cloud and SaaS platforms, including Snowflake and similar environments, to prevent credential-based unauthorized access.\n- Audit and revoke unnecessary privileged access for all active users, applying the principle of least privilege across internal and third-party systems.\n\n**Long-term improvements:**\n- Implement a formal Insider Threat Program (ITP) with continuous behavioral monitoring and anomaly detection for users with elevated data access.\n- Establish robust offboarding and access review procedures triggered by role changes, including military personnel with dual roles in corporate environments.\n- Deploy Data Loss Prevention (DLP) tools to detect and block large-scale exfiltration of sensitive data across endpoints and cloud services.\n\n**Detection measures:**\n- Enable SIEM alerting for unusual data access patterns, such as bulk downloads or access outside of normal working hours by privileged accounts.\n- Conduct regular third-party access reviews to ensure cloud platform customers (e.g., Snowflake tenants) maintain adequate security controls within their own environments.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 - Account Management","CIS Control 6 - Access Control Management","CIS Control 13 - Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 PS-7 (External Personnel Security)","NIST SP 800-53 AU-12 (Audit Record Generation)","NIST Insider Threat Guide (SP 800-53 AT-2)","GDPR Article 32 - Security of Processing","GDPR Article 33 - Notification of Personal Data Breach","MITRE ATT&CK T1078 - Valid Accounts","MITRE ATT&CK T1041 - Exfiltration Over C2 Channel",{},"published","2026-09-25T22:20:49.628775+00:00","2026-09-25T22:20:49.355+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fcyberscoop.com\u002Fcameron-wagenius-att-snowflake-attacks-sentenced\u002F","army-soldier-sentenced-for-spree-of-attacks-on-at-t-snowflake-and-other-major-co-febe8c","Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":46,"name":47,"slug":48,"description":49,"color":50},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"079ef47f-cfca-48cc-bc43-e4d77781b326","2026-09-26","morning","ThreatNoir Weekend Brief — September 26","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-26\u002Fthreatnoir-morning-brief-2026-09-26.mp3",[59,63,67],{"slug":60,"name":61,"problem":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":64,"name":65,"problem":66},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",{"slug":68,"name":69,"problem":70},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]