Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

U.S. Army soldier Cameron John Wagenius, operating under the cybercriminal alias "Kiberphant0m," exploited Snowflake cloud storage vulnerabilities to steal call and text metadata for over 100 million AT&T customers in 2024. Working with co-conspirators from a military base in South Korea, Wagenius targeted telecommunications companies worldwide including AT&T and Verizon, using exposed credentials and lack of multi-factor authentication to access sensitive data. The group extorted victims for Bitcoin payments, with AT&T reportedly paying $370,000 in ransom, before Wagenius was sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution.

This incident highlights the growing threat of insider attacks and the critical importance of cloud security controls, as organizations increasingly face sophisticated extortion schemes targeting cloud-stored telecommunications metadata and customer information.

Why This Matters Now

This case demonstrates the rising threat of insider attacks combined with cloud security vulnerabilities, as telecommunications companies face increased targeting by sophisticated extortion groups exploiting weak authentication controls and exposed credentials in cloud storage platforms.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attackers exploited Snowflake cloud storage accounts with exposed credentials and no multi-factor authentication to steal call and text metadata for over 100 million customers.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely have constrained this telecom breach by segmenting cloud workloads and restricting lateral movement across multiple provider environments. The attack's massive scope across dozens of telecom companies could have been significantly reduced through east-west traffic controls and identity-aware access policies.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Cloud native security fabric would likely have reduced the initial attack surface by implementing identity-aware access controls and workload isolation around Snowflake instances, potentially limiting the scope of credential-based compromise across telecom environments.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero trust segmentation would likely have constrained privilege escalation by enforcing least-privilege access policies around sensitive database workloads, potentially reducing the attacker's ability to access high-value customer data repositories across multiple telecom environments.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic security controls would likely have significantly constrained lateral movement between telecom provider environments, potentially reducing the attacker's ability to pivot across multiple cloud data stores and limiting access to additional provider networks.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility and control mechanisms would likely have detected and constrained command channel establishment across different cloud environments, potentially limiting the attacker's ability to maintain coordinated access across multiple telecom provider infrastructures.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security and policy enforcement would likely have constrained large-scale data exfiltration by monitoring and controlling outbound data flows from telecom cloud environments, potentially reducing the volume of customer metadata that could be extracted simultaneously.

Impact (Mitigations)

While extortion activities would likely still occur, the reduced scope of accessible customer data and constrained lateral movement across telecom environments could have significantly limited the attacker's leverage and the scale of threatened data disclosure.

Impact at a Glance

Affected Business Functions

  • Customer Communications Services
  • Call Detail Records Management
  • Customer Privacy Protection
  • Regulatory Compliance
Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $370,000

Data Exposure

Call and text metadata for over 100 million AT&T customers including source and destination numbers, timestamps, and call duration. Metadata for high-profile individuals including then President-elect Donald Trump and Vice President Kamala Harris. Alleged NSA schematics and national security information.

Recommended Actions

  • • Implement Zero Trust Segmentation with identity-based policies to prevent lateral movement across cloud databases and telecom infrastructure
  • • Deploy Encrypted Traffic (HPE) controls with MACsec and IPsec to protect call metadata and customer data in transit
  • • Enforce Egress Security & Policy Enforcement to detect and block unauthorized data exfiltration to external destinations
  • • Establish Multicloud Visibility & Control with centralized policy management to monitor anomalous access patterns across Snowflake and other cloud services
  • • Deploy Threat Detection & Anomaly Response capabilities to baseline normal access patterns and alert on credential abuse or bulk data downloads

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image