U.S. Army Soldier Sentenced to Prison for Massive Cyber Extortion Campaign Targeting AT&T and Global Telecom Firms

Cameron John Wagenius, a 22-year-old U.S. Army soldier formerly stationed in South Korea, was sentenced today to 70 months in federal prison for orchestrating a sophisticated cybercrime campaign that compromised the personal metadata of over 100 million AT&T customers. In addition to his custodial sentence, Wagenius was ordered to pay $294,978 in restitution, marking a significant conclusion to a case that exposed profound vulnerabilities in corporate cloud storage security and highlighted the risks of the insider threat within the United States military.

Operating under the digital alias Kiberphant0m, Wagenius leveraged his access and technical acumen to execute a series of high-profile data breaches and extortion attempts. His criminal activities, which targeted multiple telecommunications giants globally, relied on exploiting misconfigured credentials and the absence of multi-factor authentication (MFA) across cloud-based storage services, specifically those hosted by Snowflake.

A Chronology of the Kiberphant0m Breach

The trajectory of the Kiberphant0m operation began in 2024, when Wagenius and a cadre of co-conspirators identified that several large corporate entities were failing to secure their cloud data. By harvesting exposed credentials, the group bypassed traditional perimeter security to gain unauthorized access to vast repositories of sensitive customer information.

• October 2024: Wagenius publicly announced on various cybercrime forums that he had successfully exfiltrated call and text metadata—including timestamps, durations, and source/destination phone numbers—for tens of millions of AT&T subscribers.
• November 2024: Investigative reporting by KrebsOnSecurity identified a probable link between the Kiberphant0m persona and a U.S. soldier based in South Korea, triggering an immediate multi-agency investigation.
• December 2024: Federal authorities apprehended Wagenius. He was subsequently charged in two separate federal indictments, to which he pleaded guilty, acknowledging his role in the breaches and the extortion schemes.
• August 2026: Conor Riley Moucka, one of Wagenius’s primary co-conspirators, entered a guilty plea, further solidifying the government’s case against the network.
• September 2026: Federal prosecutors filed a comprehensive sentencing memorandum detailing not only the original crimes but also the defendant’s persistent attempts to conduct illicit research while in custody.

The Anatomy of the Extortion Network

Wagenius did not act in a vacuum. His criminal network was comprised of individuals with varying degrees of experience in the dark web and malicious hacking. Among his key associates was Kenneth Schuchman, a 28-year-old from Vancouver, Washington, with a documented history of cybercriminal activity. Schuchman had previously gained notoriety in 2019 for his role in operating the Satori botnet, a massive collection of compromised Internet-of-Things (IoT) devices used to facilitate large-scale distributed denial-of-service (DDoS) attacks.

Another prominent figure in the network, John Erin Binns, remains a significant interest for international law enforcement. Binns, an American currently residing in Turkey, is linked to the 2021 breach of T-Mobile, which exposed the personal information of at least 76 million customers. The international nature of this conspiracy—stretching from U.S. military bases in South Korea to Canada and Turkey—underscores the complexity of modern cyber-extortion syndicates.

Institutional Responses and the Insider Threat

The involvement of an active-duty soldier holding a secret security clearance presented a unique challenge for the Department of Defense. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS), emphasized the gravity of the situation.

"We don’t often get leads where there’s an active-duty soldier with a secret clearance who is creating hacking tools and trafficking in data," Russell stated. "That doesn’t happen every day, and so when that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."

The investigation required a high-level collaboration between the DCIS, the Federal Bureau of Investigation (FBI), the Army Criminal Investigative Division (CID), and the U.S. Secret Service. This unified task force was critical in identifying that the threat was not merely external, but one that utilized the trust inherent in military service to mask illicit activity.

Persistent Malicious Intent in Custody

One of the most alarming aspects of the sentencing memorandum is the disclosure that Wagenius continued to seek out security vulnerabilities even after his arrest. While awaiting sentencing in a Bureau of Prisons (BOP) facility, Wagenius allegedly exploited the access of other inmates to use email systems for the purpose of querying commercial artificial intelligence tools.

According to the government, Wagenius used "prompt injection" techniques—a method designed to circumvent the safety filters of AI models—to request specific information regarding Windows 10 privilege escalation vulnerabilities and command injection exploits for networking hardware. Furthermore, he inquired about the construction of improvised antennas to extend radio reception within the prison environment and sought research materials on the mechanics of prison escapes.

When confronted by authorities, Wagenius claimed he was conducting this research to assist the BOP in identifying its own security flaws. However, prosecutors viewed these actions as evidence of a deep-seated commitment to malicious hacking that persisted despite his confinement.

Broader Implications for Corporate Security

Despite the massive scale of the data stolen, the financial windfall for Wagenius was remarkably low. Prosecutors noted that his total profit from selling the stolen metadata amounted to approximately $1,500. This disparity between the potential harm caused—to over 100 million customers—and the actual financial gain serves as a grim case study in modern cybercrime.

The primary lesson for the private sector is the necessity of strict identity and access management. The Snowflake breach, which served as the primary entry point for Wagenius, was enabled by a lack of mandatory multi-factor authentication. In the wake of these events, many major service providers have moved to mandate MFA across all accounts, recognizing that in a world where passwords can be stolen or purchased, identity verification is the final line of defense.

Furthermore, the case highlights the risks associated with the proliferation of AI in the hands of malicious actors. By using AI to automate the discovery of vulnerabilities, individuals like Wagenius can significantly lower the barrier to entry for complex cyberattacks. The "prompt injection" tactics employed by the defendant during his time in prison suggest that even incarcerated individuals with limited resources can leverage advanced technology to pose a continuous threat to secure systems.

Conclusion: A Deterrence Model

The sentencing of Cameron John Wagenius to nearly six years in prison sends a clear message regarding the consequences of cyber-extortion, particularly when it involves individuals tasked with protecting national interests. The case has spurred a re-evaluation of how the U.S. military monitors the digital activities of its personnel and how corporations handle the security of sensitive metadata in the cloud.

As the legal proceedings against other members of the conspiracy continue, the focus will likely shift toward the long-term impact on the victims of these data breaches. For the 100 million AT&T customers whose information was compromised, the threat of identity theft and targeted phishing remains a lingering consequence of a breach that began with a soldier and an unsecured cloud account. The Justice Department’s success in this case demonstrates that while the digital landscape is vast and often elusive, the coordinated efforts of federal agencies can hold even the most sophisticated "insider" threats to account.