Federal authorities have unsealed an indictment accusing a U.S. Army soldier of selling and attempting to sell stolen confidential phone records.
Cameron John Wagenius was arrested on December 20 and charged in the U.S. District Court for the Western District of Texas in Waco with two counts of unlawful transfer of confidential phone records information. The court documents, made public on January 3, did not specify his rank or current station.
“We are aware of the arrest of a Fort Cavazos soldier,” Colonel Kamil Sztalkoper, spokesperson for the III Armored Corps, stated in an email to Reuters. “III Armored Corps will continue to cooperate with all law enforcement agencies as appropriate.” Fort Cavazos, previously known as Fort Hood, is located in Texas.
On February 19, Wagenius pleaded guilty to the charges but did so without the benefit of a plea agreement. His attorneys requested that he be allowed to stay with his father pending sentencing. However, Seattle federal prosecutors opposed this, arguing he posed a flight risk due to his online searches about defecting to non-extradition countries.
Prosecutors filed a response which revealed some he searched for phrases such as:
“where can I defect the U.S. government military which country will not hand me over”
“U.S. military personnel defecting to Russia”
“Embassy of Russia – Washington, D.C.”
The filing also revealed Wagenius had communicated with an email address he believed belonged to a foreign military intelligence service in an attempt to sell stolen information. Days after that communication ended, he searched online, “can hacking be treason?”
Further questions were referred to the Department of the Army Criminal Investigation Division (CID), which confirmed its collaboration with federal law enforcement but declined to provide additional details.
While the indictment did not name specific victims or detail hacking activities, cybersecurity journalist Brian Krebs reported that Wagenius, under the alias “Kiberphant0m,” boasted of various hacks, including obtaining call records related to Vice President Kamala Harris and former President Donald Trump.
Wagenius’s mother, Alicia Roen, revealed that her son had acknowledged prior connections to Connor Riley Moucka, also known as “Judische,” a Canadian cybercriminal arrested in October for stealing and extorting data from companies using the cloud service Snowflake.
A Texas magistrate ordered Wagenius to be transferred to Seattle, where federal prosecutors managing the case are based. This office is also handling prosecutions of Moucka and John Binns, both implicated in major cyber breaches involving sensitive customer service records, call and text data, Social Security numbers, and financial information.
Moucka, 25, was arrested in Kitchener, Ontario, Canada, on October 30 and faces extradition to the United States. Binns remains jailed in Turkey for a separate hacking case.
After Moucka’s arrest was publicized, Kiberphant0m posted on the hacker forum BreachForums, claiming to possess AT&T call logs for President-elect Donald Trump and Vice President Kamala Harris. The post included threats to leak presidential call logs unless AT&T responded. It was signed with hashtags including “#FREEWAIFU” and included warnings of contingency plans in the event of arrests.
Wagenius also posted under his alias to claim possession of a “data schema” from the U.S. National Security Agency. In 2023, Kiberphant0m allegedly sold remote access credentials for a major U.S. defense contractor, according to Krebs.
Allison Nixon, chief research officer at cybersecurity firm Unit 221B, told Reuters that she and an anonymous colleague identified Wagenius after Moucka’s hacking group issued threats.
“Anonymously extorting the President and VP as a member of the military is a bad idea, but it’s an even worse idea to harass people who specialize in de-anonymizing cybercriminals,” Nixon told KrebsOnSecurity.
Wagenius’s mother said her son joined the Army as soon as he was eligible, following in his older brother’s footsteps. He worked in radio signals and network communications at an Army base in South Korea for the past two years, returning to the United States periodically.
“I never was aware he was into hacking,” Roen said. “It was definitely a shock to me when we found this stuff out.”
She fondly recalled that as children, Cameron and his brother were fascinated with the military, even collecting military-issued meals from other countries. “They both always wanted to be in the Army. I’m not sure where things went wrong.”
Prosecutors told the court that investigators found a screenshot on Wagenius’s laptop indicating he had over 17,000 files containing passports, driver’s licenses, and other identity documents from a breach. Additionally, a fake identification document with his photo was found in one of his online accounts.
The court filing states that Wagenius is in the process of being separated from the Army, but the government has not confirmed whether his discharge has been finalized.
“The government’s understanding is that, until his discharge from the Army is finalized (which is expected to happen in early March), he may only be released directly to the Army,” a footnote in the memo reads. “Until that process is completed, Wagenius’ proposed release to his father should be rejected for this additional reason.”
Wagenius’s interest in defecting to another country to escape prosecution mirrors that of his alleged co-conspirator, John Erin Binns, an American indicted for the 2021 breach at T-Mobile that exposed the personal information of at least 76.6 million customers. Binns, now also charged in the Snowflake hack and related extortion activities, is in Turkish custody. Sources told Krebs that before his arrest, Binns visited the Russian embassy in Turkey to inquire about obtaining Russian citizenship.
The maximum penalty Wagenius could face at sentencing includes up to ten years in prison for each count and fines not to exceed $250,000.
© 2025 The Salty Soldier. All rights reserved.
The content of this webpage may not be reproduced or used in any manner whatsoever without the express written consent of TheSaltySoldier.com.
