Cybercrime Weekly – October 2026, Week 1 – Issue #192

US soldier gets 70 months for the Snowflake extortion campaign

Threat Actor

Malicious Actor

Aktivitätszeitraum

2024

Geltungsbereich

United States

Straftat

Hacking and extortion campaign

Victims

165 organizations

Financial Losses

Unbekannt

Former US Army soldier Cameron John Wagenius, 21, has been sentenced to 70 months in prison for his role in a hacking and extortion campaign targeting at least 10 US technology and telecommunications companies. Wagenius, who used the online names “kiberphant0m” and “cyb3rph4nt0m,” was arrested in Texas in December 2024 and pleaded guilty to hacking AT&T and Verizon, along with aggravated identity theft, wire fraud conspiracy and computer-related extortion.

Gerichtsunterlagen zufolge stahlen Wagenius und seine Komplizen Anmeldedaten und drangen in Unternehmensnetzwerke ein. Anschließend drohten sie damit, die gestohlenen Daten in Cybercrime-Foren zu veröffentlichen, falls die Opfer kein Lösegeld zahlten. Die Gruppe versuchte, mindestens 1 Million US-Dollar zu erpressen, und nutzte Teile der gestohlenen Informationen für weitere Betrugsversuche.

He is the third person prosecuted over the 2024 Snowflake campaign, which also involves Connor Riley Moucka and John Erin Binns, accused of helping breach more than 165 organizations through accounts linked to Snowflake’s cloud data platform. Victims included AT&T, Ticketmaster, Santander, Los Angeles Unified, LendingTree, Pure Storage, Advance Auto Parts and Neiman Marcus. Moucka pleaded guilty in August 2026 and faces up to 30 years; sentencing is set for 27 October 2026.

Also: two former US Air Force members jailed for business email fraud

Two former US Air Force members were sentenced to a combined 189 months for phishing and business email compromise. While stationed at Dover Air Force Base, they stole email and financial information and used fake emails to redirect victims’ payments to accounts controlled by their accomplices.

Der Rydox-Marktplatz-Administrator bekennt sich nach 7.600 Transaktionen schuldig

Threat Actor

Malicious actor

Aktivitätszeitraum

Active since 2016

Geltungsbereich

United States

Straftat

ID theft, money laundering

Victims

7,600+ transactions

Financial Losses

232.000 USD oder mehr

Ardit Kutleshi, 28, ein kosovarischer Staatsangehöriger, hat sich schuldig bekannt zu Vorwürfen im Zusammenhang mit Rydox, einer illegalen Plattform für den Kauf und Verkauf gestohlener personenbezogener Daten und Cybercrime-Tools. Laut Gerichtsakten hat Rydox seit mindestens 2016 mehr als 7.600 Transaktionen durchgeführt und dabei Erlöse von mindestens 232.000 US-Dollar erzielt.

Kutleshi pleaded guilty in the US District Court for the Western District of Pennsylvania to aggravated identity theft and conspiracy to commit money laundering. He was arrested in Kosovo in December 2024 and extradited to the United States in 2025; that same month US authorities seized the Rydox[.]cc domain. He faces a mandatory minimum of two years for aggravated identity theft and up to 20 years on the laundering charge.

Niederländische Polizei verhaftet ShinyHunters-Verdächtigen in Amsterdam

Threat Actor

Hacker group

Aktivitätszeitraum

Unbekannt

Geltungsbereich

Niederlande

Straftat

Involvement with hacker group

Victims

Unbekannt

Financial Losses

Unbekannt

Die niederländische Polizei hat einen 24-jährigen Mann aus Amsterdam festgenommen, der im Verdacht steht, zur Hackergruppe „ShinyHunters“ zu gehören. Der Mann wurde am 15. September 2026 festgenommen. Bei einer Durchsuchung fand die Polizei auf seinem Laptop eine große Menge an Informationen, darunter Details zu zwei geplanten Morden im Ausland, und vermutet, dass er die Morde möglicherweise in Auftrag gegeben hat; dieser Teil der Ermittlungen läuft getrennt vom Fall „ShinyHunters“. Die Polizei beschlagnahmte zudem mehrere Datenträger und schließt weitere Festnahmen nicht aus. Die Behörden haben weder den Namen des Mannes noch weitere Details bekannt gegeben.

US man sentenced to 40 years for sextortion of minors via a hacked Snapchat account

Malachi Morgan Thomas, a US resident, has been given a 40-year prison sentence for sexual exploitation of children and possession of child sexual abuse material. The US Department of Justice says Thomas used a hacked Snapchat account to coerce girls aged 12 to 17 into performing explicit acts, threatening to hack the victims’ accounts or harm them and their families if they did not comply. Prosecutors said he knew that several victims had a history of anxiety, depression and other mental health issues, that many had previously been subjected to sexual abuse, and that at least one was in foster care.

Spanien verhaftet Verdächtigen hinter €1-Mio.-Parameter-Manipulationsschwindel

Threat Actor

Malicious Insider

Aktivitätszeitraum

Unbekannt

Geltungsbereich

Spanien

Straftat

Online-Betrug

Victims

Major companies, payment gateways

Financial Losses

More than €1 million

Spanish National Police have arrested a man allegedly responsible for a network of online scams targeting major companies, with combined losses estimated at more than €1 million. According to authorities, the suspect manipulated communications between users and payment gateways using parameter tampering: by altering transaction parameters, he caused payment systems to validate transactions that had not actually been paid for in full.

The scheme allowed him to obtain concert and event tickets, airline tickets, hotel bookings and other services, including food deliveries from high-end restaurants. He also accessed internal corporate platforms to obtain employee-only benefits and redirect transactions. Police said he used numerous email accounts, identities and payment methods to conceal his activity, and was eventually arrested in a suite at a luxury hotel in Madrid’s Salamanca district.

Ex-NCA officer ordered to repay £1.8M after stealing seized Bitcoin

Threat Actor

Malicious Insider

Aktivitätszeitraum

2025

Geltungsbereich

Vereinigtes Königreich

Straftat

Gelddiebstahl und Geldwäsche

Victims

Unbekannt

Financial Losses

50 BTC, im Wert von ~60.000 GBP

A former officer of the UK’s National Crime Agency has been ordered to repay more than £1.8 million after stealing Bitcoin seized during an investigation into a dark web crime network. Paul Chowles, 44, was jailed for five years and six months in 2025 after admitting theft and money laundering. While working on the investigation, Chowles had access to digital devices seized by authorities and helped analyse cryptocurrency found on them.

He stole 50 Bitcoin, worth about £60,000 at the time, then moved it through a series of transactions in an attempt to hide the trail. Police recovered 30 Bitcoin. The cryptocurrency had been seized during the investigation into Silk Road 2.0, and a confiscation order of £1,810,678.93 was secured against Chowles, an amount that includes the current value of the recovered Bitcoin.