Federal authorities have unsealed an indictment accusing a U.S. Army soldier of selling and attempting to sell stolen confidential phone records.
Cameron John Wagenius was arrested on December 20 and charged in the U.S. District Court for the Western District of Texas in Waco with two counts of unlawful transfer of confidential phone records information. The court documents, made public on Monday, do not specify his rank or current station.
“We are aware of the arrest of a Fort Cavazos soldier,” Colonel Kamil Sztalkoper, spokesperson for the III Armored Corps, stated in an email to Reuters. “III Armored Corps will continue to cooperate with all law enforcement agencies as appropriate.” Fort Cavazos, previously known as Fort Hood, is located in Texas.
Further questions were referred to the Department of the Army Criminal Investigation Division (CID), which confirmed its collaboration with federal law enforcement but declined to provide additional details.
The brief indictment does not name specific victims, detail hacking activities, or include personal information about Wagenius. However, cybersecurity journalist Brian Krebs reported that Wagenius operated under the alias “Kiberphant0m” online and had boasted of various hacks, including claims of obtaining call records related to Vice President Kamala Harris and former President Donald Trump.
Wagenius’s mother, Alicia Roen, revealed that her son had acknowledged prior connections to Connor Riley Moucka, also known as “Judische,” a Canadian cybercriminal arrested in October for stealing and extorting data from companies using the cloud service Snowflake.
A Texas magistrate ordered Wagenius to be transferred to Seattle, where federal prosecutors managing the case are based. This office is also handling prosecutions of Moucka and John Binns, who are implicated in breaches involving billions of sensitive customer service records, call and text history data, banking information, Social Security numbers, and other personal details.
Moucka, 25, was arrested at his residence in Kitchener, Ontario, Canada, on October 30 and now faces extradition to the United States. Binns remains jailed in Turkey in connection with a separate hacking case.
After Moucka’s arrest was publicized, Kiberphant0m posted on the hacker forum BreachForums, claiming to possess AT&T call logs for President-elect Donald Trump and Vice President Kamala Harris. The post included threats to leak presidential call logs unless AT&T responded. It was signed with hashtags including “#FREEWAIFU” and included warnings of contingency plans in the event of arrests.
Wagenius also posted under his alias to claim possession of a “data schema” from the U.S. National Security Agency.
In 2023, Kiberphant0m allegedly sold remote access credentials for a major U.S. defense contractor, according to Krebs.
Allison Nixon, chief research officer at cybersecurity firm Unit 221B, told Reuters that she and an anonymous colleague identified Wagenius after Moucka’s hacking group issued threats.
“Anonymously extorting the President and VP as a member of the military is a bad idea, but it’s an even worse idea to harass people who specialize in de-anonymizing cybercriminals,” Nixon told KrebsOnSecurity.
Wagenius’s mother said her son joined the Army as soon as he was eligible, following in his older brother’s footsteps. He worked in radio signals and network communications at an Army base in South Korea for the past two years, returning to the United States periodically.
“I never was aware he was into hacking,” Roen said. “It was definitely a shock to me when we found this stuff out.”
She fondly recalled that as children, Cameron and his brother were fascinated with the military, even collecting military-issued meals from other countries. “They both always wanted to be in the Army. I’m not sure where things went wrong.”
© 2025 The Salty Soldier All rights reserved.
The content of this webpage may not be reproduced or used in any manner whatsoever without the express written consent of TheSaltySoldier.com.
