The kiberphant0m telecom hacking sentence landed this week: former U.S. Army soldier Cameron John Wagenius, 22, who operated online under the handle “kiberphant0m,” was sentenced to 70 months in prison and ordered to pay $294,978 in restitution for a sweeping hacking and extortion scheme that targeted telecommunications companies and exposed sensitive data, the U.S. Department of Justice announced. Wagenius, most recently stationed in Texas, carried out the campaign while on active duty — betraying, in prosecutors’ words, the trust placed in him as a soldier.
What the kiberphant0m telecom hacking sentence covers
According to the DOJ release, Wagenius conspired to hack into telecommunications companies’ databases, access sensitive records, and extort the companies by threatening to release the stolen data unless ransoms were paid. In November 2024, he made two online posts disclosing stolen confidential non-content call detail records belonging to a government official and family members of another former official, and threatened to release additional confidential records unless paid a ransom. The text of one post suggested he was motivated by a desire to retaliate for the then-recent arrest of another cybercriminal.
“Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “He targeted U.S. and foreign telecommunications companies, compromised the sensitive data of countless people, and even sought to traffic stolen information to a foreign intelligence service.”
The kiberphant0m telecom hacking sentence reflects the scale of the scheme: between April 2023 and December 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations, obtaining login credentials for protected computer networks — in part using a hacking tool he helped develop called SSH Brute. The group used Telegram group chats to transfer stolen credentials and coordinate unauthorized access.
Extortion, SIM-swapping, and more than $1 million in demands
After stealing data, Wagenius and his co-conspirators extorted victim organizations both privately and in public forums, threatening to post stolen data on cybercrime forums such as BreachForums and XSS.is. In other instances, they offered stolen data for sale for thousands of dollars via forum posts. They successfully sold at least some of the data and used stolen data to perpetrate other frauds, including SIM-swapping. In total, the group attempted to extort at least $1 million from victim data owners.
“Mr. Wagenius engaged in a long spree of criminal conduct attempting to blackmail hacking victims for more than $1 million,” said First Assistant U.S. Attorney Charles Neil Floyd for the Western District of Washington. “He was also motivated by a desire to achieve status within criminal hacking communities.”
The investigation moved quickly once the extortion went public. “The FBI and its law enforcement partners moved quickly to identify, locate, and arrest Cameron Wagenius,” said Assistant Director Brett Leatherman of the FBI Cyber Division, noting that the FBI worked alongside the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service and the Army to arrest him within weeks of his public extortion threats.
Guilty pleas and the road to the kiberphant0m telecom hacking sentence
Wagenius pleaded guilty in the Western District of Washington to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft on July 15, 2025. In a separate case in the same district, he pleaded guilty on March 5, 2025, to two counts of unlawful transfer of confidential phone records information.
“Spending more than a year stealing confidential data and then threatening to expose it, Mr. Wagenius attempted to extort multiple organizations for a combined total of more than $1 million,” said Special Agent in Charge W. Mike Herrington of the FBI Seattle field office. “It is especially shocking that a member of our armed forces, sworn to defend Americans and their Constitutional rights, would engage in such a violation of privacy.”
The case was investigated by the FBI and DCIS, with assistance from the Army’s Criminal Investigative Division, the U.S. Attorney’s Office for the Western District of Texas, and the National Security Cyber Section. It was prosecuted by Senior Counsel Louisa Becker and Trial Attorney George Brown of the DOJ’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Sok Tea Jiang for the Western District of Washington.
The sentence is a reminder of how aggressively federal authorities are pursuing telecom intrusions and data extortion schemes. For related coverage, read our report on the New Mexico Facebook privacy lawsuit heading to a jury and our coverage of the Marcel Reed doxxing case. For the full official account, see the Department of Justice press release on the sentencing.
Frequently Asked Questions
Who is kiberphant0m?
“Kiberphant0m” was the online handle of Cameron John Wagenius, a 22-year-old former U.S. Army soldier most recently stationed in Texas, who carried out a hacking and extortion campaign while on active duty.
What was the kiberphant0m telecom hacking sentence?
Wagenius was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for conspiring to hack telecommunications companies’ databases and extort the victims.
What did the hacking scheme involve?
Between April 2023 and December 2024, Wagenius and co-conspirators stole credentials from at least 10 victim organizations using a tool called SSH Brute, coordinated over Telegram, and attempted to extort at least $1 million — including threats to post data on BreachForums and XSS.is, and SIM-swapping fraud.
What charges did Wagenius plead guilty to?
He pleaded guilty to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft in July 2025, plus two counts of unlawful transfer of confidential phone records information in March 2025, all in the Western District of Washington.
