US Army soldier arrested in connection with AT&T, Verizon data breaches

Federal authorities have reportedly arrested a U.S. Army soldier in connection with a series of cyberattacks that compromised customer data at AT&T Inc. and Verizon Communications Inc.

Famous cybersecurity reporter Brian Krebs Break the news on Monday. Cameron Wagenius was reportedly arrested on December 20 near a U.S. Army base in Texas. According to Krebs, Wagenius’ hacker pseudonym is Kiberphant0m.

The two-page indictment that preceded the arrests did not detail the cyberattack at the center of the case or the organizations affected. However, Krebs reports that through conversations with Vagnius’ mother and a cybersecurity researcher, we can piece together what happened.

The indictment reportedly involves cyberattacks that compromised AT&T and Verizon customer information. AT&T records stolen from the carrier’s Snowflake environment, which was compromised in a hacking campaign exposed June. Google’s Mandiant division discovered the campaign and determined it affected more than 160 Snowflake users.

The cyberattack did not exploit a software vulnerability. Instead, the hackers behind the campaign used stolen login credentials from a previous breach to log into the affected organizations’ Snowflake accounts.

July, AT&T disclose Hackers stole six months of call and text message logs from almost all customers. This data set includes the numbers the customer called, the duration of the call, and related details. The hackers also gained access to certain technical data, specifically unique identification data for the cell towers that handle affected users’ communications.

Last month, Canadian authorities arrested The person believed to be behind the cyber attack. Before his arrest, the hacker told Krebs that he had “no interest” in selling the data obtained through the Snowflake account breach. Instead, he reportedly delegated the task to other hackers such as Vagnius.

According to Krebs, Wagnius is a U.S. Army communications specialist who has been stationed in South Korea for the past two years. According to reports, he works in “radio signals and network communications.”

Shortly after the Snowflake suspects were arrested, Vagnius posted alleged phone calls between President-elect Donald Trump and Vice President Kamala Harris to a hacking forum. He threatened to release more logs unless AT&T paid a ransom.

Last month, Wagenius offered to sell call records stolen from the Verizon premium calling app. The service is widely used by U.S. government agencies and first responders

In a follow-up post published a few days later, Wagenius reportedly offered a SIM swapping service aimed at users of Verizon’s premium calling app. SIM swapping is a type of cyber attack in which hackers trick a business operator into transferring phone numbers from a victim’s phone to a malicious device. The malicious device can then be used to intercept the victim’s communications.

Krebs said Wagnius appeared to be involved in other hacking activities. Last year, he reportedly offered to sell remote login credentials stolen from U.S. defense contractors. Additionally, Wagenius reportedly claims to operate a large botnet, or network of malicious devices, used to launch distributed denial-of-service attacks.

Prosecutors initially filed an indictment against Vaginius in Texas court. The case has been transferred to the U.S. District Court for the Western District of Washington in Seattle.

Photo: AT&T