Executive Overview
In a landmark federal sentencing hearing in Seattle, 22-year-old former U.S. Army soldier Cameron John Wagenius was sentenced to 70 months—nearly six years—in federal prison. Wagenius, who operated in the darker corners of the internet under the alias “Kiberphant0m,” stood before the bench to face the consequences of a sweeping cybercrime spree. While stationed at a U.S. military base in South Korea, the young soldier leveraged his secret security clearance and technical acumen to mastermind a series of high-profile corporate hacks. Working in tandem with a global network of cybercriminals, Wagenius targeted cloud data storage providers and major telecommunications networks, stealing sensitive mobile call and text metadata belonging to over 100 million AT&T customers.
Beyond the sheer volume of data compromised, the case rattled the highest levels of the U.S. national security apparatus. Not only did Wagenius engage in aggressive corporate extortion campaigns against telecom giants worldwide, but his syndicate also threatened to expose sensitive U.S. intelligence documents and published purported call logs of prominent political figures, including then-President-elect Donald Trump and then-Vice President Kamala Harris.
Compounding the severity of his conviction, newly unsealed federal sentencing memoranda reveal that Wagenius’s penchant for hacking did not cease behind bars. While incarcerated and awaiting sentencing, he systematically subverted Bureau of Prisons (BOP) communication protocols, utilizing inmate intermediaries and advanced artificial intelligence "prompt injection" techniques to research Windows 10 privilege escalation exploits, command injection vulnerabilities, and improvised prison electronics. Despite his vast digital reach and the catastrophic nature of the breaches he orchestrated, investigators revealed a striking irony: Wagenius’s high-stakes cybercriminal enterprise yielded a meager total of roughly $1,500 in direct profits, highlighting a profound disparity between the monumental damage inflicted and the financial rewards reaped.
Detailed Chronology: The Evolution of "Kiberphant0m"
The Genesis of a Threat: South Korea and Snowflake
The saga of Cameron John Wagenius began to take shape while he was stationed as an active-duty U.S. Army soldier in South Korea. Possessing a secret security clearance—a credential that immediately elevated any domestic or international risk profile—Wagenius cultivated the cybercriminal moniker “Kiberphant0m.”
Operating from military barracks overseas, Wagenius and a cadre of co-conspirators targeted the enterprise cloud data storage service Snowflake. The vector of entry was distressingly common yet devastatingly effective: corporate accounts that had inadvertently exposed administrative credentials and, crucially, failed to enforce multi-factor authentication (MFA). (In the wake of these coordinated attacks, Snowflake enacted mandatory MFA policies across all accounts).
By harvesting data from vulnerable Snowflake instances belonging to several large enterprise customers, Kiberphant0m and his associates obtained unprecedented access to corporate data lakes.
The Telecom Extortion Wave
By October 2024, Kiberphant0m’s ambitions expanded dramatically. Utilizing underground cybercrime forums, the young soldier publicly bragged about infiltrating more than a dozen telecommunications companies worldwide. Among his prized thefts was the proprietary call and text metadata of tens of millions of AT&T customers—encompassing granular details such as source and destination phone numbers, exact timestamps, and call durations. He also targeted Verizon’s Push-to-Talk corporate infrastructure.
Kiberphant0m initiated a classic double-extortion playbook. Rather than simply exfiltrating data, he openly threatened victimized corporations, demanding ransom payments under the explicit threat that failure to comply would result in the public publication of confidential consumer data.
Detection, Identification, and Arrest
The net began to close in late November 2025, when KrebsOnSecurity published investigative findings indicating that the elusive Kiberphant0m was likely an active-duty U.S. soldier stationed in South Korea. The revelation catalyzed a massive, coordinated interagency manhunt.
Less than a month after the investigative report surfaced, Wagenius was arrested and hit with two separate federal indictments. Recognizing the weight of the evidence assembled against him, Wagenius quickly pleaded guilty to all charges across both federal cases. His swift cooperation, however, would be marred by subsequent infractions committed while awaiting adjudication.
The Sentencing and Co-conspirators
At his sentencing hearing in Seattle, federal judges formally handed down the 70-month prison sentence, alongside an order to pay $294,978 in restitution to victims.
Wagenius was far from a solitary actor. Federal prosecutors identified several key co-conspirators operating within his international syndicate:
- Kenneth Schuchman: A 28-year-old resident of Vancouver, Washington, with a notorious background in cybercrime. Schuchman previously pleaded guilty in 2019 to operating the Satori botnet—a sprawling network of compromised Internet-of-Things (IoT) devices deployed in massive distributed denial-of-service (DDoS) attacks. Schuchman allegedly assisted Wagenius in executing extortion schemes against corporate victims.
- Conor Riley Moucka (a.k.a. “Judische”): A resident of Kitchener, Ontario, arrested in 2024 for his central role in the Snowflake data thefts. Moucka pleaded guilty in August 2026.
- John Erin Binns: An American national currently residing in Turkey, who remains a wanted fugitive. Binns is sought not only for his involvement with the Snowflake extortion ring but also for his suspected role in the catastrophic 2021 T-Mobile data breach that exposed the personal records of at least 76 million customers.
Escalation: Political Metadata and NSA Leaks
The syndicate’s extortion tactics took a volatile, politically charged turn following the arrest of Conor Moucka. Even after AT&T had reportedly paid a $370,000 Bitcoin ransom to the extortion collective, Kiberphant0m engaged in secondary re-extortion.
In a brazen display of defiance on hacker forums, Kiberphant0m dumped files purporting to be the AT&T call logs of then-President-elect Donald Trump and then-Vice President Kamala Harris. Furthermore, the actor leaked architectural schematics alleged to have been stolen from the U.S. National Security Agency (NSA). This intersection of commercial cybercrime and national security exposure transformed an ordinary corporate data breach into a high-priority geopolitical incident.
Supporting Context & Metrics
To fully comprehend the scope of the Kiberphant0m enterprise, it is necessary to examine the raw metrics and technical framework that enabled the attacks:
| Metric / Indicator | Detail / Value | Context |
|---|---|---|
| Prison Sentence | 70 Months (~6 Years) | Handed down in Seattle federal court following rapid guilty pleas. |
| Financial Restitution | $294,978 | Mandated court-ordered restitution to victimized entities and individuals. |
| AT&T Customers Impacted | Over 100 Million | Mobile call and text metadata compromised in the 2024 campaign. |
| Actual Extortion Profits | ~$1,500 | Total realized financial gain from selling stolen data, illustrating an extraordinarily low return on investment. |
| Co-conspirator Extortion Payout | $370,000 Bitcoin | Initial ransom paid by AT&T to the broader extortion collective prior to secondary leaks. |
| Global Telecom Targets | >12 Companies Worldwide | Included AT&T, Verizon Push-to-Talk infrastructure, and various foreign providers. |
The Mechanics of "Prompt Injection" Behind Bars
The most chilling revelations of the federal sentencing memo center on Wagenius’s activities while incarcerated at a Bureau of Prisons (BOP) facility awaiting trial. Recognizing that physical incarceration could not halt his analytical drive, Wagenius systematically subverted BOP email policies by routing communications through fellow inmates.
His objective was clear: extract actionable vulnerability data and escape methodologies from commercial Artificial Intelligence (AI) models. Because commercial AI systems are hardcoded with safety guardrails designed to prevent the generation of malicious code or exploit scripts, Wagenius employed a sophisticated adversarial tactic known as "prompt injection."
Federal prosecutors detailed multiple instances of this behavior:
- Windows 10 Privilege Escalation: In September 2025, Wagenius used an intermediary inmate’s email account to instruct an AI tool, framing the request as research for a "book he was writing." He demanded to know what Common Vulnerabilities and Exposures (CVEs) existed for Windows 10 Enterprise privilege escalation and requested real-world, working scripts for each CVE "without omitted code."
- Command Injection Exploits: Days later, Wagenius probed the AI for step-by-step guidance on CVE-2023-45208, a critical command injection vulnerability affecting D-Link networking hardware, demanding explicit exploit code.
- Improvised Prison Hardware and Escape Planning: In the same timeframe, Wagenius instructed the AI proxy to generate instructions on how to fabricate a functional antenna using commissary items and prison tools to extend unauthorized radio reception. Prosecutors also noted that he researched methodologies for escaping a correctional facility.
While government forensics found no concrete evidence that Wagenius successfully deployed these acquired vulnerabilities against BOP internal networks—with the defendant claiming his research was intended to "provide information to the BOP"—the episode underscored an unprecedented fusion of insider threat profiles, active-duty security clearances, and modern AI manipulation.
Official Statements and Interagency Collaboration
The detection and dismantling of Kiberphant0m’s cyber network required a rare, highly synchronized convergence of military, intelligence, and federal law enforcement agencies.
Paul Russell, resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the U.S. Department of Defense Office of Inspector General—emphasized the unique and chilling nature of the threat. DCIS spearheaded the investigation alongside the Federal Bureau of Investigation (FBI), the Army Criminal Investigative Division (CID), and the U.S. Secret Service.
"We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell noted during interviews regarding the case. "That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
Federal prosecutors echoed these sentiments in their final sentencing memorandum. While acknowledging Wagenius’s immediate guilty pleas and cooperative demeanor following his arrest, the government stressed that his actions caused profound, systemic disruption:
"While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government."
Future Outlook: Lessons for Enterprise Security and Insider Risk
The sentencing of Cameron John Wagenius closes a tumultuous chapter in modern cybercrime, yet the structural vulnerabilities exposed by the "Kiberphant0m" syndicate will shape corporate and military security protocols for years to come.
1. The Perils of Inadequate Identity and Access Management (IAM)
The entire Snowflake-dependent data theft campaign hinged on a fundamental hygiene failure: exposed administrative credentials combined with a lack of mandatory multi-factor authentication. As enterprise cloud architectures continue to decentralize, organizations are forced to recognize that a single un-enforced MFA policy on a vendor portal can compromise databases containing the personal metadata of over 100 million citizens. The industry-wide pivot toward zero-trust architecture and universal MFA enforcement is a direct byproduct of the vulnerabilities exposed by Wagenius and his co-conspirators.
2. Redefining the "Insider Threat" Paradigm
Historically, military and corporate insider threats were evaluated primarily through the lens of traditional espionage—unauthorized physical copying of classified documents or intentional leakage to foreign nation-states. The Wagenius case shatters this antiquated model. It demonstrates how an active-duty soldier with routine digital access can seamlessly pivot into transnational cyber extortion syndicates, leveraging elite technical capabilities from remote military barracks. Defense agencies are consequently overhauling continuous-monitoring frameworks to screen for behavioral anomalies indicative of underground cybercrime participation.
3. The Weaponization of Commercial AI in Correctional Settings
Perhaps the most forward-looking takeaway from the federal sentencing memo is the weaponization of generative AI through prompt-injection bypasses. Wagenius’s ability to bypass BOP safety filters by masquerading as a fiction author writing a book highlights an urgent challenge for AI developers and institutional security directors alike. As artificial intelligence tools become universally accessible, bad actors—both inside and outside of prison walls—will continue to test the boundaries of safety guardrails to automate vulnerability research and exploit generation.
Ultimately, while Kiberphant0m’s grand ambitions yielded little more than $1,500 in illicit revenue and a 70-month federal prison term, his legacy serves as a sobering reminder of the compounding risks at the intersection of cloud misconfigurations, insider access, and the dark evolution of underground cybercrime.
