A U.S. Army solder accused of attempting to extort AT&T by threatening to expose the confidential call records of high-profile politicians was arrested by police in Texas earlier this month, The Desk has learned.
Cameron John Wagenius was detained by federal law enforcement authorities in Waco on December 20, two days after a grand jury in Washington state indicted him on two criminal counts related to the unauthorized collection and attempted distribution of confidential phone records, including those connected to officials close to President-elect Donald Trump and Vice President Kamala Harris.
The records were stolen from computer networks run by Snowflake, a cloud storage service used by AT&T and a number of other companies. In court records reviewed by The Desk, Wagenius is not accused of targeting Snowflake directly, but investigators believe he used the name “Kiberphant0m” in an online forum frequented by hackers and cybersecurity researchers, where he allegedly tried to extort AT&T into paying a ransom.
In a post made on November 5, Wagenius allegedly threatened to leak call logs connected to Trump and Harris officials if AT&T did not reach out to him or another hacker who went by the pseudonym “Reddinton.”
“In the event you do not reach out to us @ATNT, all presidential government call logs will be leaked,” Wagenius allegedly threatened. ” You don’t think we don’t have plans in the event of an arrest? Think again.”
It isn’t clear what those plans were, but additional posts have not been made by Kiberphant0m since Wagenius’ arrest. He participated in a preliminary court appearance in Texas on December 20, where federal prosecutors requested his extradition to Washington state. A portion of the court docket was made public on Monday.
The arrest is the latest connected to the theft of AT&T’s call records over the past few months. John Binns, an American man living in Turkey, was identified as a suspect in the cyberattack in July. Earlier this year, The Desk was the first to report that Binns had been indicted and arrested on suspicion of carrying out a cyberattack against T-Mobile; that case is separate from the attack against Snowflake and AT&T.
In November, a Canadian man named Alexander “Connor” Moucka was arrested by law enforcement authorities for allegedly targeting Snowflake as well, according to reports from Bloomberg and 404 Media. In addition to AT&T, Moucka allegedly obtained data from Ticketmaster, Advanced Auto parts, Santander Bank and a Lending Tree subsidiary business.
Wagenius is not accused of directly attacking Snowflake or AT&T, but investigators believe he obtained call records from either Binns or Moucka with the direction to distribute them in online hacking forums. The real-world identity of Wagenius’ alleged co-conspirator, Reddinton, remains unknown.
Wagenius enlisted in the U.S. Army four years ago, according to a relative who spoke with The Desk late Monday evening. The relative affirmed Wagenius was briefly deployed to South Korea, where he collected signals intelligence for the 35th Air Defense Artillery Brigade. Wagenius was last stationed at Fort Cavazos (formerly Fort Hood), a U.S. Army post that is about an hour outside of Waco.
