4 minhigh
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
U.S. soldier Cameron Wagenius (Kiberphant0m) sentenced to 70 months for stealing AT&T metadata on 100M+ customers via Snowflake credential abuse and extorting telecom companies. Wagenius exploited Snowflake customer accounts that lacked MFA to download call and text metadata from AT&T and Verizon Push-to-Talk. Co-conspirators include a Satori botnet operator and the suspect behind the 2021 T-Mobile breach. AT&T paid a $370,000 Bitcoin ransom; Wagenius personally earned only ~$1,500.
Sens:7dConf:
IOCs1
1cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Enforce MFA on all Snowflake and cloud storage accounts
- Rotate any credentials previously exposed without MFA protection
- Audit cloud storage access logs for anomalous query patterns
Key Takeaways
- Wagenius earned only ~$1,500 total from data sales despite massive breach impact
- Co-conspirator Kenneth Schuchman previously operated the Satori IoT DDoS botnet
- Wagenius used other inmates' email accounts to prompt AI tools for CVE exploitation code
- He requested details on CVE-2023-45208, a D-Link command injection vulnerability
- Co-conspirator John Erin Binns is also wanted for the 2021 T-Mobile breach (76M customers)
Attack Chain
- Initial Access: Exploited Snowflake customer accounts using exposed credentials without MFA
- Collection: Downloaded call and text metadata for over 100 million AT&T customers
- Extortion: Posted stolen data on cybercrime forums and demanded payment from telecom companies
- Payment: AT&T paid $370,000 Bitcoin ransom to the extortion group
- Post-Arrest: Wagenius used inmate emails to research CVEs and prison escape methods via AI tools
Affected Systems
- Snowflake cloud data storage accounts
- AT&T telecommunications infrastructure
- Verizon Push-to-Talk business systems
- D-Link networking devices (CVE-2023-45208)
- U.S. Bureau of Prisons computer systems
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2023-45208 | D-Link networking devices | Command injection vulnerability researched by Wagenius while incarcerated. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Attack targeted cloud storage services via valid credentials; no endpoint telemetry involved. |
| Network Visibility | Medium | Cloud API authentication and query logs could reveal anomalous access patterns and bulk data exports. |
| Detection Difficulty | Hard | Valid credentials used without MFA; access appears legitimate until anomalous query volume or data export size is analyzed. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Cloud storage account access from new IP geographies after credential exposure indicates stolen credential use (T1078) | Cloud auth logs with source IP and geolocation | Initial Access | Medium — remote workforce and VPN use vary |
| Bulk data export queries from cloud storage accounts lacking MFA indicate data theft (T1530) | Snowflake query history and data volume logs | Collection | Medium — legitimate analytics workloads export large datasets |
Required Log Sources
- Cloud provider authentication logs
- Snowflake query history logs
- Identity provider SSO logs
- Cloud storage access logs
Key Behavioral Indicators
- New IP geographies accessing cloud storage accounts
- Bulk data export queries exceeding normal baselines
- Cloud storage login without MFA authentication
- Concurrent sessions from disparate geographic locations
Control Gaps
- MFA not enforced on Snowflake customer accounts
- Credential exposure monitoring absent
- Cloud data export anomaly detection absent
- Insider threat vetting for cleared personnel insufficient
False Positive Assessment
Medium — bulk cloud data access can be legitimate for analytics workloads; credential reuse without MFA was previously common before Snowflake mandated it.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Mandate MFA across all cloud platforms and SaaS applications
- Implement conditional access policies restricting cloud storage by geography
- Enable cloud storage query volume alerting and export monitoring
User Protection
- Monitor telecom accounts for unauthorized access or SIM swap attempts
- Alert customers whose metadata was stolen to phishing risk
Security Awareness
- Screen personnel with security clearances for insider threat indicators
- Restrict AI tool access from controlled environments to prevent exploit research
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping3 techniques
Tactic
Initial Access
Additional IOCs
- Command Lines:
- Purpose: Requested AI-generated exploit code for CVE-2023-45208 via inmate email | Tools:
email,commercial AI tool| Stage: Post-arrest research
- Purpose: Requested AI-generated exploit code for CVE-2023-45208 via inmate email | Tools:
Showing defanged values
- cveCVE-2023-45208Command injection vulnerability researched by Wagenius while incarcerated.