U.S. Army Soldier Sentenced to Prison for Massive Telecommunications Data Extortion Scheme

Cameron John Wagenius, a 22-year-old U.S. Army soldier who utilized the online pseudonym Kiberphant0m to execute a sophisticated campaign of corporate extortion and data theft, was sentenced today in a Seattle federal courtroom to 70 months in prison. The sentencing concludes a high-profile investigation involving the theft of sensitive call and text metadata belonging to more than 100 million AT&T customers, alongside breaches of multiple international telecommunications firms. In addition to the nearly six-year custodial sentence, Judge John C. Coughenour ordered Wagenius to pay $294,978 in restitution to his corporate victims.

The case, which drew the immediate attention of the Department of Defense, the FBI, and the U.S. Secret Service, underscores the escalating threat posed by "insider threats" who leverage high-level security clearances to facilitate cybercriminal activity. Despite his youth and limited financial gains—prosecutors noted he earned roughly $1,500 from the operation—the scope of his activities spanned multiple continents and implicated national security interests.

Chronology of the Kiberphant0m Campaign

The operation centered on exploiting vulnerabilities in the cloud-based data storage provider Snowflake. In early 2024, while stationed in South Korea, Wagenius identified and targeted large enterprise customers of the platform who had failed to implement multi-factor authentication (MFA) protocols. By compromising exposed credentials, Wagenius and his associates gained unauthorized access to vast repositories of consumer data.

• Early 2024: Wagenius begins his campaign under the handle Kiberphant0m, targeting Snowflake-linked accounts.
• October 2024: The perpetrator publicly claims responsibility for the theft of metadata for tens of millions of AT&T customers on dark-web forums, including timestamps, duration, and source-destination call logs.
• November 2025: KrebsOnSecurity publishes an investigative report identifying a high probability that Kiberphant0m is a U.S. soldier based in South Korea.
• December 2025: Law enforcement executes an arrest warrant for Wagenius; federal indictments follow in two separate jurisdictions.
• August 2026: Co-conspirator Conor Riley Moucka, known as "Judische," enters a guilty plea in a Canadian court.
• September 2026: Federal prosecutors file a comprehensive sentencing memo detailing Wagenius’s continued attempts to compromise prison computer systems while awaiting trial.
• Current Date: Final sentencing handed down by the U.S. District Court for the Western District of Washington.

The Network of Co-Conspirators

Wagenius did not operate in a vacuum. Federal prosecutors identified a network of seasoned cybercriminals who provided technical support and operational infrastructure. Kenneth Schuchman, a 28-year-old from Vancouver, Washington, served as a primary collaborator. Schuchman brought significant experience to the partnership, having previously pleaded guilty in 2019 for his role in operating the "Satori" botnet—a massive collection of compromised Internet-of-Things devices responsible for large-scale distributed denial-of-service (DDoS) attacks.

Other figures in the case include Conor Riley Moucka, an Ontario resident who acted as a key participant, and John Erin Binns, an American national currently residing in Turkey. Binns remains a person of interest in several international investigations, most notably the 2021 T-Mobile data breach that affected at least 76 million individuals. The collaboration between these actors highlights the modern architecture of cybercrime: a decentralized, global network of hackers trading exploits, credentials, and extortion tactics to maximize leverage against corporate targets.

National Security Implications

The investigation shifted from a standard white-collar crime inquiry to a national security priority when the extortion tactics escalated. Following the arrest of his associate Moucka, and despite having already secured a $370,000 Bitcoin ransom payment from AT&T, Wagenius attempted to exert further pressure on the company.

He publicly leaked purported call logs belonging to high-ranking U.S. political figures, including then President-elect Donald Trump and then Vice President Kamala Harris. Simultaneously, he claimed to possess and threatened to release classified schematics stolen from the National Security Agency (NSA). This reckless escalation forced the Defense Criminal Investigative Service (DCIS) to lead a multi-agency task force.

Paul Russell, a resident agent in charge at the DCIS, described the apprehension of an active-duty soldier with a secret clearance as a "unique" and "serious" scenario. The presence of an insider threat within the military infrastructure necessitated a rapid and aggressive inter-agency response to ensure that no further classified material was compromised or distributed.

Incarceration and Continued Illicit Behavior

One of the most alarming aspects of the government’s sentencing memo was the evidence that Wagenius attempted to continue his cyber-activities even while held in federal custody. In September 2025, while awaiting his sentencing, Wagenius exploited the email access provided to inmates to send messages to external contacts. These messages contained instructions to utilize commercial Artificial Intelligence (AI) tools to research specific vulnerabilities, including "privilege escalation" techniques and "command injection" flaws in D-Link hardware.

Wagenius attempted to bypass the safety guardrails of these AI models by employing "prompt injection" techniques, framing his queries as research for a book. His attempts included asking for instructions on how to construct improvised antennas within the prison environment to extend radio signals and, more ominously, conducting research on potential methods for prison escape.

The government noted in its filing that while there was no evidence he successfully deployed these vulnerabilities against Bureau of Prisons (BOP) systems, the intent to breach secure networks remained consistent throughout his pre-sentencing detention. Wagenius claimed his inquiries were meant to "provide information to the BOP," a defense the prosecution and the court found entirely unpersuasive.

The Broader Impact: Data Privacy and Enterprise Security

The case of Cameron Wagenius serves as a cautionary tale for modern corporate cybersecurity. The ease with which a single individual, armed with basic credential-harvesting techniques, was able to penetrate the defenses of massive telecommunications providers reveals critical failures in enterprise security hygiene.

1. The MFA Imperative: The breaches were primarily enabled by the absence of multi-factor authentication. As Snowflake and other cloud providers have since mandated, MFA is no longer an optional security layer but a foundational requirement.
2. The "Low-Value" Paradox: While Wagenius netted only a fraction of the potential ransom value he demanded, the cost to the companies—in terms of legal fees, remediation, brand damage, and victim notification—runs into the millions of dollars.
3. The Rise of AI-Assisted Cybercrime: The case illustrates how readily accessible, commercial-grade AI tools are being weaponized by bad actors to accelerate the discovery of vulnerabilities. The "prompt injection" tactics used by Wagenius signal a new frontier in the cat-and-mouse game between cybersecurity researchers and those looking to exploit software.

As the digital landscape becomes increasingly interconnected, the ability of unauthorized individuals to bypass corporate perimeters continues to pose a systemic risk. The sentencing of Wagenius serves as a deterrent, but the vulnerability of the underlying infrastructure remains a significant concern for policymakers and corporate boards alike. The Justice Department’s success in tracking an elusive persona like Kiberphant0m across borders and through the complexities of the digital underground demonstrates a hardening of the government’s stance on cyber-extortion, yet the persistent nature of such threats suggests that this will remain a defining challenge for the decade.