U.S. Army Soldier Behind Massive AT&T and Snowflake Extortion Schemes Sentenced to 70 Months in Federal Prison

SEATTLE — A 22-year-old U.S. Army soldier who orchestrated a devastating string of cyberattacks under the alias "Kiberphant0m," stealing the call and text metadata of more than 100 million AT&T customers and targeting telecommunications giants worldwide, was sentenced today in federal court to 70 months in prison.

Cameron John Wagenius, stationed at a U.S. military base in South Korea during the height of his criminal operations, stood before a federal judge in Seattle to face the consequences of a sweeping digital extortion campaign. In addition to the nearly six-year prison sentence, Wagenius was ordered to pay $294,978 in restitution to his victims.

The sentencing marks a critical milestone in a multi-agency international investigation into a loose-knit collective of hackers who exploited unsecured cloud storage credentials, breached major corporations, and attempted to ransom stolen data back to corporate executives and government entities. Despite the staggering scale of the data he compromised—including logs belonging to high-profile political figures and sensitive national security schematics—prosecutors revealed that Wagenius netted a paltry $1,500 for his illicit efforts.

The Main Facts: Anatomy of a Global Telecom Breach

The case against Wagenius unraveled one of the most high-profile cyber extortion campaigns in recent memory. Operating under his digital persona, Kiberphant0m, the young soldier leveraged exposed credentials from corporate clients of the cloud storage provider Snowflake. Because these specific corporate accounts failed to enforce multi-factor authentication (MFA)—a vulnerability that prompted Snowflake to subsequently mandate MFA across all accounts—Wagenius and his co-conspirators were able to download massive repositories of sensitive internal data.

By October 2024, Wagenius began openly boasting on underground cybercrime forums that he had successfully pilfered call and text metadata from tens of millions of AT&T customers. This stolen metadata included crucial communication logs such as source and destination telephone numbers, call timestamps, and call durations.

According to federal indictments and investigative reports, Kiberphant0m claimed responsibility for breaching more than a dozen telecommunications companies globally. Among the targets was Verizon’s Push-to-Talk business. Rather than quietly selling the data on dark web marketplaces, Wagenius and his associates adopted a strategy of aggressive public extortion, threatening to leak the proprietary information unless hefty ransoms were paid in cryptocurrency.

The operation reached an alarming threshold when the extortionists began re-extorting their victims and threatening the exposure of classified national security data. Following the arrest of a co-conspirator—and after AT&T had already paid the hacking collective a $370,000 Bitcoin ransom—Kiberphant0m uploaded data he claimed represented the AT&T call logs of then-President-elect Donald Trump and then-Vice President Kamala Harris. He also published documents allegedly stolen from the U.S. National Security Agency (NSA).

Chronology of an Investigation: From Anonymous Forums to a Federal Cell

The downfall of "Kiberphant0m" unfolded rapidly over a frantic 14-month period, driven by investigative journalism, digital forensics, and unprecedented cooperation among federal law enforcement and military agencies.

• October 2024: Operating under the moniker Kiberphant0m, Cameron Wagenius takes to underground cybercrime forums to publicly brag about stealing call and text metadata belonging to tens of millions of AT&T customers, while issuing threats against multiple global telecom providers.
• Late November 2024: Cybersecurity journalist Brian Krebs publishes reporting on KrebsOnSecurity, warning that the elusive hacker behind the Snowflake-related extortions is likely an active-duty U.S. soldier stationed in South Korea.
• December 2024: Less than a month after the public identification, Wagenius is officially arrested and slapped with two separate federal indictments. He swiftly pleads guilty to all counts.
• September 2025: While incarcerated and awaiting sentencing at a federal facility, Wagenius attempts to probe the computer network of the Bureau of Prisons (BOP), utilizing other inmates’ email accounts to query commercial AI tools for privilege escalation vulnerabilities and prison radio improvisation techniques.
• September 19, 2026: Federal prosecutors in Seattle file a comprehensive sentencing memorandum detailing Wagenius’s post-arrest digital misconduct, shedding light on his persistent attempts to exploit system vulnerabilities even from behind bars.
• August 2026: Co-conspirator Conor Riley Moucka (a.k.a. "Judische"), a Canadian national from Kitchener, Ontario, formally pleads guilty for his role in the Snowflake extortion schemes.
• Today: Wagenius is formally sentenced in Seattle to 70 months in federal prison and ordered to pay nearly $300,000 in restitution.

Supporting Data and Co-Conspirators

While Wagenius was a central figure in the enterprise, federal prosecutors emphasize that he did not operate in a vacuum. The investigation exposed a transnational network of cybercriminals with deep ties to historic malware and data breach operations.

The Co-Conspirators

• Kenneth Schuchman (28, Vancouver, Washington): Prosecutors identified Schuchman as a key assistant in Wagenius’s extortion plots. Schuchman brings a notorious background to the case; in 2019, he pleaded guilty to operating the Satori botnet, a massive army of compromised Internet-of-Things (IoT) devices responsible for large-scale distributed denial-of-service (DDoS) attacks.
• Conor Riley Moucka (a.k.a. "Judische," Kitchener, Ontario): Arrested in 2024, Moucka played an integral role in handling the logistics of the Snowflake data thefts and ransom demands. He entered a guilty plea in August 2026.
• John Erin Binns (American living in Turkey): Also wanted in connection with the Snowflake data thefts, Binns remains a fugitive from U.S. authorities. He is separately sought for his alleged role in a massive 2021 T-Mobile data breach that exposed the personal information of at least 76 million customers.

The Financial Disconnect

Despite the catastrophic potential of the stolen data and the international panic caused by the leaks, the sentencing memo underscored a striking economic reality: Wagenius’s criminal enterprise was profoundly unprofitable. Investigators estimate that despite holding terabytes of corporate data and demanding hundreds of thousands of dollars from corporations, Wagenius personally walked away with a meager $1,500 from selling stolen data.

Official Responses: An Unprecedented Insider Threat

The involvement of an active-duty U.S. Army soldier holding a secret security clearance sent shockwaves through the Department of Defense and civilian law enforcement agencies.

Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the DoD Office of Inspector General—highlighted the unique dangers of the case. When intelligence surfaced indicating a cleared service member was developing malicious tools and trafficking stolen data, DCIS launched an immediate joint task force alongside the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service.

"We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell remarked. "That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."

Post-Arrest Misconduct and AI "Prompt Injection"

Adding a bizarre twist to an already complex prosecution, the government’s sentencing memorandum revealed that Wagenius refused to curb his technical curiosities even after his arrest. While awaiting sentencing in Bureau of Prisons (BOP) custody, Wagenius repeatedly violated facility computer-use policies.

Prosecutors detailed how Wagenius covertly used the email accounts of fellow inmates to prompt commercial artificial intelligence tools. Using a technique known as prompt injection—where attackers frame deceptive inputs within fictional constructs, such as writing a book—Wagenius attempted to trick AI models into bypassing safety guardrails.

Records show Wagenius queried AI tools for:

• Specific Common Vulnerabilities and Exposures (CVEs) related to Windows 10 Enterprise privilege escalation, alongside real-world working scripts without omitted code.
• Step-by-step exploit instructions for CVE-2023-45208, a command injection vulnerability affecting D-Link networking devices.
• Instructions on how to construct improvised radio antennas using prison commissary items to extend reception.
• Research materials detailing methods for escaping a correctional facility.

When confronted by authorities regarding these searches, Wagenius claimed he was merely researching potential system vulnerabilities to hand over to the BOP as a good-faith gesture. Prosecutors noted there is no evidence he successfully deployed these exploits within the prison network.

Implications: The Intersection of National Security, Cloud Security, and Insider Threats

The sentencing of Cameron Wagenius serves as a watershed moment with profound implications for cybersecurity, military counterintelligence, and corporate data governance.

1. The Modern Insider Threat: Traditionally, military insider threats involving security clearances focused on physical espionage, traditional spying, or unauthorized leaks to foreign governments. The "Kiberphant0m" case demonstrates that modern insiders can pose equal—if not greater—dangers by weaponizing technical competencies from inside military installations, leveraging commercial cloud vulnerabilities for private criminal gain.
2. Cloud Security and MFA Mandates: The exploitation of Snowflake accounts underscored a systemic weakness in corporate cloud hygiene. The fallout from the attacks forced cloud storage providers and enterprise clients to fundamentally reevaluate access controls, cementing multi-factor authentication not as an optional security enhancement, but as an absolute baseline requirement.
3. The Weaponization of AI in Captive Environments: Wagenius’s attempts to use generative AI to bypass security controls while incarcerated highlight a terrifying new frontier for correctional facilities and digital safety. As AI models become more sophisticated, bad actors inside and outside of prison walls will continue testing methods to coerce artificial intelligence into generating malicious code and exploit documentation under the guise of creative writing or academic research.

As Wagenius begins his 70-month term, federal authorities hope the sentence delivers a definitive deterrent against tech-savvy service members tempted to cross the line from defending the nation to exploiting its digital infrastructure.