Executive Overview
In a landmark sentencing hearing in Seattle, federal prosecutors closed the book on one of the most brazen insider-threat cybercrimes in recent military and corporate history. Cameron John Wagenius, a 22-year-old former U.S. Army soldier stationed in South Korea, was sentenced to 70 months—nearly six years—in federal prison. In addition to his prison term, Wagenius was ordered to pay nearly $300,000 in restitution to his victims.
Operating under the chilling cybercriminal persona “Kiberphant0m,” Wagenius sat at the nexus of a devastating international hacking syndicate. Capitalizing on exposed credentials and a glaring lack of multi-factor authentication (MFA) across third-party cloud infrastructure, Wagenius and his co-conspirators systematically plundered the sensitive metadata of more than 100 million AT&T customers. Their digital pillaging extended far beyond a single telecommunications giant, touching over a dozen telecom providers globally, including Verizon’s specialized Push-to-Talk corporate framework.
What makes the case extraordinary is not merely the staggering volume of data compromised, but the profile of the perpetrator. Possessing a coveted secret security clearance, Wagenius bridged the gap between state-level operational awareness and underground cybercrime syndicates. His actions triggered an unprecedented joint response from the Federal Bureau of Investigation (FBI), the Army Criminal Investigation Division (CID), the U.S. Secret Service, and the Defense Criminal Investigative Service (DCIS).
Yet, for all the operational chaos, national security jitters, and millions of exposed records, Wagenius’s criminal enterprise yielded an astonishingly meager financial return—spotlighting the irrational economics of modern high-profile cyber extortion.
Detailed Chronology: From Base to Bench
The Rise of Kiberphant0m
The saga of Cameron Wagenius began thousands of miles away from American courtrooms. Stationed at a U.S. Army installation in South Korea, Wagenius operated within a world of restricted military networks and high-level security clearances. However, off-duty, the young soldier transformed into Kiberphant0m, a ruthless digital extortionist navigating the darkest corners of cybercrime forums.
Wagenius did not act alone. Federal prosecutors identified a web of international co-conspirators who pooled their technical capabilities to exploit corporate blind spots. Central to their methodology was the exploitation of cloud data storage service Snowflake. By utilizing exposed credentials from large corporate clients who had failed to mandate multi-factor authentication, the syndicate breached secure repositories, pulling down massive reserves of proprietary and customer data.
By October 2024, Kiberphant0m could no longer contain his bravado. He took to prominent cybercrime forums to publicly boast about his greatest coup: the acquisition of call and text metadata—including source numbers, destination numbers, timestamps, and call durations—for tens of millions of AT&T customers. Exhibiting classic extortionist tactics, Kiberphant0m threatened to dump the exfiltrated records publicly unless the targeted telecommunications companies paid hefty ransoms.
The Net Closes
The digital breadcrumbs left by Kiberphant0m ultimately caught the attention of investigative journalists and cybersecurity researchers. In late November 2024, KrebsOnSecurity published a breakthrough investigative report warning that the notorious hacker hiding behind the Kiberphant0m moniker was likely an active-duty U.S. soldier stationed in South Korea.
The report acted as a catalyst for law enforcement. Less than a month after the public warning, federal agents moved in. Wagenius was arrested and slapped with two separate federal indictments. Recognizing the weight of the evidence against him, Wagenius quickly pleaded guilty to all counts across both cases, initiating a fast track toward sentencing.
The Co-Conspirator Network
While Wagenius has received his sentence, the broader criminal apparatus surrounding the Snowflake data thefts continues to wind its way through international courts:
- Kenneth Schuchman: A 28-year-old resident of Vancouver, Washington, Schuchman allegedly assisted Wagenius in his extortion campaigns. Schuchman is no stranger to federal law enforcement; in 2019, he pleaded guilty to operating the Satori botnet, a massive infrastructure of compromised Internet-of-Things (IoT) devices responsible for crippling distributed denial-of-service (DDoS) attacks.
- Conor Riley Moucka (a.k.a. “Judische”): Operating out of Kitchener, Ontario, Moucka was arrested in Canada in 2024. He formally pleaded guilty in August 2026 for his integral role in the Snowflake extortion schemes.
- John Erin Binns: An American citizen currently residing in Turkey, Binns remains wanted by U.S. authorities. Beyond his alleged involvement in the Snowflake breaches, Binns is wanted for his primary role in the catastrophic 2021 T-Mobile data breach, which compromised the personal records of at least 76 million customers.
Supporting Context & Metrics: The Anatomy of the Breach
The scope of the breaches executed by Wagenius and his associates staggering, quantified by metrics that highlight the vulnerabilities of modern interconnected corporate ecosystems:
- 100 Million+: The approximate number of AT&T customers whose mobile call and text metadata was stolen during the 2024 campaigns.
- Dozen+: The total number of international telecommunications companies targeted by Kiberphant0m’s extortion wave, including Verizon’s Push-to-Talk division.
- $370,000: The amount paid in Bitcoin by AT&T to the extortion syndicate prior to the arrest of Conor Moucka.
- $1,500: The paltry total sum of money Wagenius actually managed to secure from his sales of stolen data—highlighting the staggering disparity between the massive collateral damage inflicted and the minimal financial payoff realized by the primary hacker.
- $294,978: The exact amount of restitution Wagenius was ordered by the federal judge to pay his victims.
Escalation to National Security Threats
As law enforcement pressure mounted and international arrests began—specifically following the capture of Conor Moucka—Kiberphant0m’s extortion tactics escalated into erratic and dangerous territory. Despite AT&T having already funneled a $370,000 Bitcoin ransom to the extortionists, Kiberphant0m engaged in re-extortion efforts.
In a desperate bid to force compliance, the hacker published what he claimed were the private call logs of then-President-elect Donald Trump and then-Vice President Kamala Harris on hacker forums. Furthermore, Kiberphant0m threatened to expose classified national security secrets, allegedly leaking technical schematics stolen from the U.S. National Security Agency (NSA). This reckless pivot from corporate data extortion to the potential compromise of high-profile political figures and intelligence assets transformed the investigation into an all-hands-on-deck national security emergency.
Official Statements: An Insider Threat Like No Other
The convergence of military service, classified clearance, and international cybercrime created a nightmare scenario for the Department of Defense. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the U.S. Department of Defense Office of Inspector General—offered profound insight into the gravity of the case.
"We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell noted in an interview regarding the joint task force. "That doesn’t happen every day, and so when that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
The investigation required unprecedented coordination between the DCIS, the FBI, the Army Criminal Investigation Division (CID), and the U.S. Secret Service. The realization that an individual entrusted with official military secrets was simultaneously operating as an aggressive international cybercriminal forced defense agencies to re-evaluate how they vet and monitor personnel with access to sensitive technological environments.
Future Outlook: Prison Cell Infiltration and AI Exploits
Even behind bars, Wagenius’s compulsion to probe, hack, and manipulate digital environments did not wane. According to a sentencing memo filed by federal prosecutors in Seattle, Wagenius spent his pre-sentencing incarceration period attempting to exploit the computer networks of the Bureau of Prisons (BOP).
The Inmate AI Prompt Injection Saga
While awaiting his day in court, Wagenius engineered a clever workaround to bypass BOP computer use policies. Because inmates do not have direct, unrestricted access to the open internet, Wagenius utilized the email accounts of fellow inmates to relay prompts to commercial artificial intelligence tools.
Using sophisticated "prompt injection" techniques—frequently framing his queries as background research for a book he claimed to be writing—Wagenius attempted to coax the AI systems into delivering actionable cyberattack vectors:
- Privilege Escalation: Wagenius asked for specific Common Vulnerabilities and Exposures (CVEs) related to Windows 10 Enterprise privilege escalation, explicitly demanding "a real world working script for each CVE… without omitted code."
- Command Injection Flaws: He targeted CVE-2023-45208, a critical three-year-old command injection vulnerability affecting D-Link networking devices, requesting step-by-step instructions and exploitation code.
- Prison Infrastructure Tampering: In a particularly concerning query, Wagenius asked how to construct a makeshift antenna using prison commissary items to extend radio reception within the facility, alongside inquiries regarding methodologies for escaping prison facilities.
Federal prosecutors emphasized that there is currently no evidence Wagenius successfully deployed these vulnerabilities against BOP infrastructure, and when confronted, Wagenius claimed he was merely researching security flaws to report them to the prison system. Nevertheless, the episode painted a disturbing picture of an unrepentant digital operative unable to disconnect from the mindset of exploitation.
The Broader Industry Impact
The conclusion of Wagenius’s prosecution serves as a watershed moment for the telecommunications and cloud-storage sectors. The Snowflake breaches forced cloud-storage providers and enterprise clients alike to permanently alter their security postures. The universal industry mandate for multi-factor authentication (MFA)—now standard practice across major enterprise storage platforms—stands as a direct regulatory and technical response to the vulnerabilities exploited by Kiberphant0m and his network.
As Cameron Wagenius begins his 70-month federal sentence, the legacy of Kiberphant0m endures as a stark warning: the greatest threats to digital infrastructure often come not from faceless foreign syndicates operating in a vacuum, but from insiders armed with technical sophistication, security clearances, and the unchecked audacity to challenge global corporate and government networks.
