{"vulnerability": "cve-2023-4520", "sightings": [{"uuid": "00d76b8b-701c-4405-a134-0d7d958ab673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45208", "type": "seen", "source": "https://t.me/ap_security/120", "content": "\ud83c\udf10\u0420\u0430\u0441\u0448\u0438\u0440\u0438\u0442\u0435\u043b\u044c \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 Wi-Fi D-Link \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 OS injection \u0438 DoS-\u0430\u0442\u0430\u043a\u0443\n\n\ud83d\udde3\u041a\u043e\u043c\u0430\u043d\u0434\u0430 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2023-45208\n\n\ud83d\udde3\u0411\u0430\u0433 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0435\u0439 \u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u0430\u0440\u0441\u0438\u0442\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b SSID, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435  ` , \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044f \u0438\u0445 \u0437\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\n\n\ud83d\udde3\u0422\u0430\u043a\u0436\u0435 \u0434\u0430\u043d\u043d\u044b\u0439 \u0431\u0430\u0433 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 parsing_xml_stasurvey \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c DoS-\u0430\u0442\u0430\u043a\u0443\n\n#cve #itnews #infosec", "creation_timestamp": "2023-10-11T11:27:07.000000Z"}, {"uuid": "69f4177d-f82f-4be9-bfb9-616491de9ab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45206", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/15424", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-45206\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)\n\ud83d\udccf Published: 2024-02-13T00:00:00.000Z\n\ud83d\udccf Modified: 2025-05-07T21:12:51.053Z\n\ud83d\udd17 References:\n1. https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories\n2. https://wiki.zimbra.com/wiki/Security_Center\n3. https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "creation_timestamp": "2025-05-07T21:22:37.000000Z"}, {"uuid": "7e9b1013-87e2-4ddd-b31f-b54d8a6a8dd0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45207", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/9174", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-45207\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)\n\ud83d\udccf Published: 2024-02-13T00:00:00.000Z\n\ud83d\udccf Modified: 2025-03-27T19:21:44.415Z\n\ud83d\udd17 References:\n1. https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories\n2. https://wiki.zimbra.com/wiki/Security_Center\n3. https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "creation_timestamp": "2025-03-27T19:26:45.000000Z"}, {"uuid": "1e1858f6-504d-4c54-bee4-b037fa80c479", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45208", "type": "seen", "source": "https://t.me/ap_security/180", "content": "\ud83c\udf10\u0420\u0430\u0441\u0448\u0438\u0440\u0438\u0442\u0435\u043b\u044c \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 Wi-Fi D-Link \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 OS injection \u0438 DoS-\u0430\u0442\u0430\u043a\u0443\n\n\ud83d\udde3\u041a\u043e\u043c\u0430\u043d\u0434\u0430 \u043d\u0435\u043c\u0435\u0446\u043a\u0438\u0445 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0443\u044e \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2023-45208\n\n\ud83d\udde3\u0411\u0430\u0433 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0435\u0439 \u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e \u043f\u0430\u0440\u0441\u0438\u0442\u044c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b SSID, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435  ` , \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u044f \u0438\u0445 \u0437\u0430 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\n\n\ud83d\udde3\u0422\u0430\u043a\u0436\u0435 \u0434\u0430\u043d\u043d\u044b\u0439 \u0431\u0430\u0433 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 parsing_xml_stasurvey \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0442\u043e\u043c\u0443, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c DoS-\u0430\u0442\u0430\u043a\u0443\n\n#cve #itnews #infosec", "creation_timestamp": "2023-10-11T11:27:07.000000Z"}, {"uuid": "4a32d3da-0fea-4739-9be9-d028992748d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45201", "type": "seen", "source": "https://t.me/cibsecurity/73394", "content": "\u203c CVE-2023-45201 \u203c\n\nOnline Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities.\u00c2\u00a0The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-11-02T01:22:06.000000Z"}, {"uuid": "e817003a-4885-4e73-b57d-874b7cd9114a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45203", "type": "seen", "source": "https://t.me/cibsecurity/73392", "content": "\u203c CVE-2023-45203 \u203c\n\nOnline Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-11-02T01:22:05.000000Z"}, {"uuid": "87bb1aec-4ae5-4e30-8c31-b9ebbe97e033", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45202", "type": "seen", "source": "https://t.me/cibsecurity/73390", "content": "\u203c CVE-2023-45202 \u203c\n\nOnline Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-11-02T01:22:03.000000Z"}, {"uuid": "bfa4d88c-5f00-4299-9415-ae8c66a14159", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45208", "type": "seen", "source": "https://t.me/cibsecurity/71895", "content": "\u203c CVE-2023-45208 \u203c\n\nA command injection in the parsing_xml_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allows attackers (within range of the repeater) to run shell commands as root during the setup process of the repeater, via a crafted SSID. Also, network names containing single quotes (in the range of the repeater) can result in a denial of service.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-10T12:29:58.000000Z"}, {"uuid": "2a8f26f4-13af-4f0e-b579-7a4238ee92d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45207", "type": "seen", "source": "https://t.me/ctinow/183970", "content": "https://ift.tt/f91S3Wb\nCVE-2023-45207", "creation_timestamp": "2024-02-13T17:22:01.000000Z"}, {"uuid": "3a0cc18f-9272-4ba1-abdd-a43639ca08e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45206", "type": "seen", "source": "https://t.me/ctinow/183969", "content": "https://ift.tt/8eh9XvG\nCVE-2023-45206", "creation_timestamp": "2024-02-13T17:22:00.000000Z"}, {"uuid": "b021bb61-0bcd-40c2-b255-cb3cd42c6fcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45204", "type": "seen", "source": "https://t.me/cibsecurity/71907", "content": "\u203c CVE-2023-45204 \u203c\n\nA vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0009), Tecnomatix Plant Simulation V2302 (All versions < V2302.0003). The affected applications contain a type confusion vulnerability while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-21268)\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-10T14:30:11.000000Z"}, {"uuid": "d209c947-1e28-4ae0-a77c-69046a4864e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45208", "type": "seen", "source": "https://t.me/sysodmins/19686", "content": "\u0423\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0438 Wi-Fi \u0441\u0438\u0433\u043d\u0430\u043b\u0430 D-Link \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u043f\u0435\u0440\u0435\u0434 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u043c\u0430\u043d\u0434\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2023-45208 \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u0435 Wi-Fi \u0441\u0438\u0433\u043d\u0430\u043b\u0430 D-Link DAP-X1860 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0442\u044c DoS-\u0430\u0442\u0430\u043a\u0438 (\u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438) \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u0414\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u0440\u0438\u0434\u0435\u0442\u0441\u044f \u0432\u044b\u043d\u0443\u0434\u0438\u0442\u044c \u0446\u0435\u043b\u0435\u0432\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e  \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438. \u041e\u0434\u043d\u0430\u043a\u043e \u044d\u0442\u043e\u0433\u043e \u043c\u043e\u0436\u043d\u043e \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0434\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u043c\u0430\u043b\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u044b \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043d\u0430 \u0443\u0441\u0438\u043b\u0438\u0442\u0435\u043b\u044c \u0441\u0438\u0433\u043d\u0430\u043b\u0430 deauth-\u043f\u0430\u043a\u0435\u0442\u044b, \u0432\u044b\u043d\u0443\u0436\u0434\u0430\u044f \u0435\u0433\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u043e\u0442 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435.\n\n\ud83d\udcde \u0422\u0430\u043a \u043a\u0430\u043a \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0441\u0432\u044f\u0437\u0430\u0442\u044c\u0441\u044f \u0441 \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430\u043c\u0438 D-Link, \u043e\u043d\u0438 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u044e\u0442, \u0447\u0442\u043e DAP-X1860 \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u0430\u0442\u0430\u043a, \u043f\u0440\u0438\u0447\u0435\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0440\u044f\u0434 \u043b\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0437\u0432\u0430\u0442\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0439.\n\n\u0422\u0438\u043f\u0438\u0447\u043d\u044b\u0439 \ud83e\udd78 \u0421\u0438\u0441\u0430\u0434\u043c\u0438\u043d", "creation_timestamp": "2023-10-11T01:31:58.000000Z"}, {"uuid": "45118864-5bef-4362-836e-eef42c0ed1a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-45208", "type": "seen", "source": "https://krebsonsecurity.com/2026/09/u-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions/", "content": "A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.\n\n\nOne of several selfies from the Facebook page of Cameron Wagenius.\n\nCameron John Wagenius, 22, was stationed at a U.S. Army base in South Korea when he adopted the cybercriminal persona “Kiberphant0m.” Working with three alleged co-conspirators, Kiberphant0m downloaded data from several large customers of the cloud data storage service Snowflake that had exposed credentials and did not enforce multi-factor authentication (Snowflake has since mandated MFA on all accounts).\n\nIn October 2024, Kiberphant0m bragged on the cybercrime forums that he’d stolen the call and text metadata (e.g. source and destination number, timestamp, duration, etc.) for tens of millions of AT&T customers. Kiberphant0m claimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish the stolen data.\n\nIn late November 2025, KrebsOnSecurity warned that Kiberphant0m was likely a U.S. soldier stationed in South Korea. Less than a month later, Wagenius was arrested and charged in two separate federal indictments, and soon pleaded guilty to all counts in both cases.\n\nAt his sentencing hearing in Seattle today, Wagenius was sentenced to nearly six years in federal prison, and ordered to pay $294,978 in restitution.\n\nFederal prosecutors said Wagenius was assisted in his efforts to extort victim companies by Kenneth Schuchman, a 28-year old man from Vancouver, Washington who has a lengthy cybercriminal history. In 2019, Schuchman pleaded guilty to operating the Satori botnet, a vast collection of hacked Internet-of-Things (IoT) devices that was used for large-scale distributed denial-of-service (DDoS) attacks.\n\nTwo other alleged co-conspirators of Wagenius are still facing charges in connection with the Snowflake data thefts; Conor Riley Moucka, a.k.a. “Judische,” of Kitchener, Ontario was arrested in 2024 and pleaded guilty in August 2026; and John Erin Binns, an American man currently living in Turkey who is also wanted for a 2021 data breach at T-Mobile that exposed the personal information of at least 76 million customers.\n\nKiberphant0m also admitted to re-extorting victims, and threatening to disclose national security secrets. Immediately following Moucka\u2019s arrest — after AT&T had already paid the extortion group a $370,000 Bitcoin ransom — Kiberphant0m posted on hacker forums what he claimed were the AT&T call logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as well as schematics allegedly stolen from the U.S. National Security Agency (NSA).\n\nPaul Russell is a resident agent in charge at the Defense Criminal Investigative Service (DCIS), the criminal investigative arm of the U.S. Department of Defense Office of Inspector General. Russell said when DCIS received information that a soldier with secret clearance was allegedly involved in cybercrime and extortion, the agency began working the investigation alongside the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service.\n\n“We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell said. “That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.”\n\nA sentencing memo (PDF) filed Sept. 19 by federal prosecutors in Seattle notes that while Wagenius pleaded guilty almost immediately and has been remarkably cooperative, he recently got caught trying to find security vulnerabilities in the BOP’s computer network. The government’s memo notes that while incarcerated and awaiting sentencing, Wagenius violated the computer use policies of the Bureau of Prisons (BOP) in attempts to learn about vulnerabilities in BOP computer systems.\n\n“According to records from BOP, in or around September 2025, Wagenius used another inmate\u2019s email system to request that the email recipient prompt a commercial AI tool to provide information about \u201c[w]hat CVE\u2019s are there for Windows 10 Enterprise privilege escalation and bypasses\u201d and to \u201c[p]rovide the CVE\u2019s and a real world working script for each CVE . . . without omitted code,\u201d the government’s memo states.\n\nThe memo states that less than a week later, Wagenius used a different inmate’s email account and requested that the email recipient prompt an AI tool to \u201c[p]rovide the step by step for CVE-2023-45208, code for this if any, and if no code exists make some, make sure to describe everything in detail.\u201d CVE-2023-45208 is a three-year-old “command injection” vulnerability in D-Link networking devices.\n\nThat same month, Wagenius allegedly again requested that the email recipient prompt AI with the question, “How do you make an antenna in a prison environment with commissary or readily available items/tools to improve/make an antenna to extend radio reception?”\n\nFederal prosecutors said Wagenius also requested that the recipient research escaping prison.\n\n“In several instances, Wagenius framed the AI queries as being posed in connection to a book he was writing. This is a common method of ‘prompt injection,’ in which attackers feed specially crafted, deceptive inputs into commercial AI tools that are programmed to avoid outputting malicious code that can be used to exploit computer vulnerabilities,” the sentencing memo reads.\n\nThe government told the court it is unaware of evidence that Wagenius figured out how to use or deploy the vulnerabilities he was researching in the BOP’s systems, and when questioned said he was only researching “potential vulnerabilities to provide information to the BOP.”\n\nIncredibly, despite the enormous financial value of the data stolen from AT&T and other telecom providers, Wagenius’s extortion efforts were largely unsuccessful. The government’s sentencing memo says Wagenius made a whopping total of around $1,500 from selling stolen data.\n\n“While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government,” the memo states.", "creation_timestamp": "2026-09-25T19:44:40.000000Z"}]}