Executive Overview
In a federal courtroom in Seattle, the digital underworld’s veneer of anonymity evaporated for a 22-year-old U.S. Army soldier whose brazen cyber-extortion campaign shook the foundations of North American telecommunications security. Cameron John Wagenius—known to cybercrime forums and federal investigators by his ominous moniker, “Kiberphant0m”—was sentenced to 70 months in federal prison. In addition to his nearly six-year sentence, Wagenius was ordered to pay nearly $300,000 in direct restitution to his victims.
Operating from an overseas military base in South Korea while holding an active secret security clearance, Wagenius spearheaded a destructive cybercrime wave. Working alongside a syndicate of seasoned international hackers, he exploited poor corporate cyber hygiene to infiltrate cloud data repositories, siphon the call and text metadata of more than 100 million AT&T customers, and extort major telecommunications infrastructure providers across the globe.
Yet, the saga of Kiberphant0m is as notable for its staggering scale as it is for its astonishing irony. Despite compromising vast troves of sensitive data—including the alleged call logs of high-profile political figures and stolen National Security Agency (NSA) schematics—Wagenius’s lucrative criminal enterprise netted a grand total of roughly $1,500. Compounding his legal peril, Wagenius demonstrated an incorrigible appetite for exploitation even while locked behind bars, caught orchestrating prison proxy schemes to harvest artificial intelligence tools for zero-day exploits and prison-break instructions.
This deep-dive investigation examines the anatomy of the Kiberphant0m enterprise, the multi-agency law enforcement response to an unprecedented insider threat, and the systemic vulnerabilities that allowed a rogue soldier to hold corporate America hostage.
Detailed Chronology: From Snowflake Exploits to Federal Sentencing
The Rise of "Kiberphant0m"
The narrative of Cameron John Wagenius’s descent into high-stakes cybercrime began while he was stationed with the U.S. Army in South Korea. Armed with a secret security clearance and a penchant for malicious code, Wagenius crafted the digital persona "Kiberphant0m." Operating in the shadows of underground hacking forums, he sought out collaborators to leverage exposed corporate credentials.
The syndicate’s primary vector of attack targeted cloud data storage service Snowflake. By identifying corporate clients who had left backend credentials exposed and failed to enforce multi-factor authentication (MFA)—a severe security oversight that Snowflake has since mitigated by mandating MFA across all platforms—the hackers accessed sprawling corporate databases.
The AT&T Breach and Global Extortion Campaign
By October 2024, Kiberphant0m’s activities escalated dramatically. He took to prominent cybercrime forums to publicly brag about breaching more than a dozen major telecommunications companies worldwide. Among his prized trophies was Verizon’s Push-to-Talk business, alongside a devastating raid on AT&T.
Wagenius and his co-conspirators downloaded the call and text metadata—comprising source and destination numbers, precise timestamps, and communication durations—for over 100 million AT&T customers. Using this data as leverage, the threat actors engaged in public extortion schemes. They demanded massive cryptocurrency payouts, threatening to dump sensitive customer data onto the open internet if their ransom demands were ignored.
The extortion syndicate’s pressure tactics eventually forced AT&T to pay a staggering $370,000 Bitcoin ransom. However, internal greed and ideological recklessness fractured the group. Following the arrest of Canadian co-conspirator Conor Riley Moucka, Kiberphant0m crossed a dangerous red line. In an act of retaliatory re-extortion, Wagenius published data sets on hacker forums purporting to show the AT&T call logs of then-President-elect Donald Trump and then-Vice President Kamala Harris. To compound the geopolitical fallout, he also leaked technical schematics allegedly pilfered from the U.S. National Security Agency (NSA).
The Investigation, Arrest, and Guilty Plea
The first major crack in Kiberphant0m’s anonymity appeared in late November 2025, when independent cyber intelligence journalism by KrebsOnSecurity published warnings suggesting that the mastermind behind the Snowflake-related extortions was likely an active-duty U.S. soldier stationed in South Korea.
The report acted as a catalyst for federal law enforcement. Less than a month later, Wagenius was apprehended. Federal prosecutors swiftly filed two separate indictments charging him with a litany of computer fraud, extortion, and identity theft offenses. Recognizing the weight of the evidence against him, Wagenius quickly pleaded guilty to all counts across both cases, setting the stage for his eventual sentencing hearing in Seattle.
Supporting Context & Metrics: The Human and Financial Footprint
To fully comprehend the magnitude of the Kiberphant0m case, one must evaluate the stark contrast between the sheer volume of compromised data and the paltry financial returns realized by the perpetrators.
The Scale of the Breach
- 100 Million+: The approximate number of AT&T customers whose call and text metadata was compromised during the 2024 operations.
- Over a Dozen: The total number of international telecommunications providers globally targeted by Wagenius and his co-conspirators.
- $370,000: The ransom amount paid in Bitcoin by AT&T to the extortion syndicate prior to the mass leaks of high-profile metadata.
- $1,500: The shocking, actual cash total Wagenius personally pocketed from selling stolen corporate data, highlighting the disparity between systemic digital damage and individual illicit profit.
- $294,978: The direct financial restitution ordered by the federal court to compensate victims of the hacks.
The Co-Conspirator Web
Wagenius did not operate in a vacuum; he was part of a transnational network of cybercriminals with deep-rooted digital histories:
- Kenneth Schuchman (28, Vancouver, Washington): Prosecutors identified Schuchman as a primary assistant in the extortion attempts. Schuchman is no stranger to federal law enforcement; in 2019, he pleaded guilty to operating the Satori botnet, a sprawling weaponized army of hacked Internet-of-Things (IoT) devices responsible for massive distributed denial-of-service (DDoS) attacks.
- Conor Riley Moucka (a.k.a. “Judische,” Kitchener, Ontario): Arrested in 2024, Moucka played a central role in the Snowflake-related data thefts and extortion coordination, ultimately pleading guilty in August 2026.
- John Erin Binns (American national living in Turkey): Wanted internationally, Binns has been heavily implicated not only in the broader Snowflake extortion ecosystem but also in the monumental 2021 T-Mobile data breach that exposed the personal identifying information of at least 76 million customers.
Official Statements and Insider Threat Realities
The involvement of an active-duty U.S. Army soldier possessing a secret security clearance transformed a standard corporate cybercrime investigation into an urgent national security priority.
Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the U.S. Department of Defense Office of Inspector General—highlighted the unprecedented nature of the case. DCIS launched a joint task force alongside the Federal Bureau of Investigation (FBI), the Army Criminal Investigative Division (CID), and the U.S. Secret Service.
"We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell stated. "That doesn’t happen every day, and so when that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
Despite Wagenius’s early guilty plea and subsequent cooperation with federal authorities, prosecutors noted that his compliance was severely undermined by ongoing behavioral issues while incarcerated.
According to a sentencing memorandum filed by federal prosecutors in Seattle, Wagenius spent his pretrial detention attempting to compromise the information technology systems of the Bureau of Prisons (BOP). Utilizing a proxy system through other inmates’ email accounts, Wagenius engaged in sophisticated "prompt injection" attacks against commercial artificial intelligence tools.
Framing his requests around a fabricated writing project, Wagenius attempted to trick AI models into bypassing safety filters to yield:
- Working, unredacted code and privilege-escalation CVEs (Common Vulnerabilities and Exposures) for Windows 10 Enterprise.
- Step-by-step exploit instructions and operational code for CVE-2023-45208, a critical command-injection vulnerability affecting D-Link networking hardware.
- Practical instructions on constructing improvised radio antennas using prison commissary items to extend reception.
- Research material detailing methodologies for escaping a federal correctional facility.
While federal prosecutors confirmed there was no evidence that Wagenius successfully deployed these exploits within BOP systems—and Wagenius claimed his research was intended to help the prison identify security flaws—the episode cemented his reputation as an unrepentant and persistent technical threat.
Future Outlook: Lessons for Enterprise Security and Defense
The sentencing of Cameron John Wagenius closes a dramatic chapter in the annals of modern cybercrime, yet it leaves open vital questions regarding corporate data protection, national security vetting, and the ethical evolution of artificial intelligence.
- Mandatory Multi-Factor Authentication (MFA): The Snowflake breaches underscore a foundational rule of modern cybersecurity: convenience cannot override security. Organizations that fail to enforce zero-trust architectures and mandatory MFA on all accounts remain sitting ducks for credential-stuffing syndicates.
- The Evolving Insider Threat: The convergence of military-grade security clearances with digital-native criminal syndicates presents a formidable challenge for defense agencies. Traditional background checks and internal security protocols must adapt to monitor digital footprints and behavioral anomalies outside standard operational parameters.
- AI Guardrails and Prompt Injection: Wagenius’s exploitation of commercial AI tools while behind bars illustrates the chilling dual-use nature of generative artificial intelligence. As threat actors increasingly weaponize LLMs (Large Language Models) to generate exploit code and bypass safety checkpoints, software providers must fortify their models against sophisticated social engineering and prompt-injection techniques.
As Kiberphant0m begins his 70-month federal prison term, the telecommunications sector and national security apparatus are left to reckon with the profound damage inflicted by a rogue soldier whose technical ambition far outstripped his financial reward—serving as a stark warning of the digital age’s most volatile intersection: human insider threats and unvetted cloud architectures.
