U.S. Army Soldier Sentenced to Prison for Massive Telecommunications Extortion and Data Theft Scheme

Cameron John Wagenius, a 22-year-old U.S. Army soldier, was sentenced to 70 months in federal prison today, marking the conclusion of a high-stakes investigation into one of the most significant breaches of telecommunications infrastructure in recent years. Operating under the pseudonym "Kiberphant0m" while stationed at a military installation in South Korea, Wagenius orchestrated a sophisticated campaign that compromised the personal metadata of over 100 million AT&T customers. In addition to the prison term, the U.S. District Court in Seattle ordered Wagenius to pay $294,978 in restitution to the victimized organizations.

The sentencing brings a definitive end to a criminal saga that spanned international borders, involved multiple high-profile co-conspirators, and placed sensitive national security concerns at the forefront of federal law enforcement priorities.

The Anatomy of a Breach: The Snowflake Exploitation

The foundation of Wagenius’s criminal enterprise rested on the exploitation of unsecured credentials. Rather than deploying traditional malware against major telecommunications providers directly, the group targeted the cloud data storage firm Snowflake. By identifying large corporate clients who had failed to implement multi-factor authentication (MFA) on their accounts, Wagenius and his associates were able to harvest vast quantities of proprietary data.

The stolen information, which included mobile call and text metadata—encompassing source and destination numbers, timestamps, and call durations—provided a detailed map of communications for tens of millions of individuals. By October 2024, the scope of the breach became public when "Kiberphant0m" began boasting on illicit cybercrime forums about his access to the records of more than a dozen global telecommunications companies, including Verizon’s specialized Push-to-Talk business services.

A Chronology of Cyber-Extortion

The timeline of the Kiberphant0m operation highlights a rapid escalation from data harvesting to brazen public extortion.

• 2024 (Early): Wagenius and his co-conspirators initiate access to various corporate accounts via exposed credentials in the Snowflake cloud environment.
• October 2024: The threat actor publicly confirms the theft of AT&T metadata, signaling a shift toward extorting the victim companies for payments in exchange for non-disclosure.
• November 2025: KrebsOnSecurity publishes a comprehensive investigation suggesting the perpetrator behind the Kiberphant0m persona is likely an active-duty U.S. soldier stationed in South Korea.
• December 2025: Law enforcement agencies, including the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service, execute an arrest of Wagenius.
• August 2026: Co-conspirator Conor Riley Moucka, also known as "Judische," enters a guilty plea in a Canadian court.
• September 2026: Federal prosecutors file a detailed sentencing memorandum revealing that even while in federal custody, Wagenius attempted to probe prison network vulnerabilities.
• Current Date: Wagenius receives his final sentence of 70 months.

The Co-Conspirators and Global Reach

Wagenius did not act in a vacuum. His operation was supported by a network of experienced cybercriminals. Kenneth Schuchman, a 28-year-old from Washington state with a documented history in the "Satori" IoT botnet—a massive collection of compromised devices used for disruptive DDoS attacks—was identified by prosecutors as a key facilitator in the extortion efforts.

The international nature of the group was further evidenced by the involvement of Conor Riley Moucka, a Canadian national, and John Erin Binns, an American citizen residing in Turkey. Binns remains a figure of intense interest for federal authorities, as he is also linked to the 2021 T-Mobile data breach that affected at least 76 million customers. The combined efforts of this group represented a significant, sustained threat to both consumer privacy and corporate integrity.

National Security Implications and "Kiberphant0m’s" Hubris

The severity of the case was amplified by the defendant’s decision to weaponize national security concerns. Following the arrest of his associate Moucka, and despite having already secured a $370,000 Bitcoin ransom from AT&T, Wagenius attempted to re-extort the provider. He published what he alleged were the call logs of high-ranking U.S. officials, including President-elect Donald Trump and Vice President Kamala Harris, alongside documents purportedly stolen from the National Security Agency (NSA).

Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS), described the case as an "insider threat" of the highest order. "We don’t often get leads where there’s an active-duty soldier with a secret clearance who is creating hacking tools and trafficking in data," Russell stated. The combination of access to military infrastructure and the capability to execute large-scale civilian breaches forced an immediate, multi-agency response to ensure that the integrity of military and government communications remained uncompromised.

In-Custody Behavior: The "Prompt Injection" Incident

Perhaps the most unusual aspect of the case is the defendant’s conduct while awaiting sentencing. According to the government’s sentencing memorandum, Wagenius continued to display an obsessive interest in cybersecurity vulnerabilities. Using the email accounts of fellow inmates, he attempted to leverage commercial Artificial Intelligence (AI) tools to identify privilege escalation vulnerabilities in Windows 10 and command injection flaws in D-Link hardware.

Wagenius famously utilized "prompt injection" techniques—a method of bypassing AI safety filters—by framing his queries as research for a book he claimed to be writing. When confronted by authorities, he attempted to justify his actions as an effort to "provide information to the Bureau of Prisons regarding potential vulnerabilities." The court remained unconvinced, citing these actions as evidence of a persistent disregard for law and institutional security policies.

Analysis: A Low-Yield, High-Harm Enterprise

Despite the massive scale of the stolen data, federal prosecutors noted a striking disparity between the volume of information exfiltrated and the financial gains realized. Wagenius’s total earnings from the operation amounted to approximately $1,500. This low monetary yield underscores a modern trend in cybercrime where the primary objective may shift from direct financial gain to notoriety, ideological disruption, or the accumulation of "reputational capital" within extremist hacking forums.

However, the "harm-to-profit" ratio remains heavily weighted toward the harm. Beyond the monetary restitution required of Wagenius, the broader impact includes the massive expenditure of taxpayer funds required for the multi-agency federal response, the erosion of public trust in telecommunications privacy, and the operational strain placed on the U.S. Army.

Broader Implications for Corporate Cybersecurity

The Kiberphant0m case serves as a cautionary tale for the modern corporate landscape. The breach of Snowflake’s environment—specifically the failure of its clients to enforce mandatory MFA—demonstrates that even the most robust data storage platforms are vulnerable when individual user hygiene is compromised. In the wake of this event, many organizations have accelerated the transition to "Zero Trust" architectures, where every access request is verified regardless of its origin.

As the Department of Defense continues to monitor for similar insider threats, the sentencing of Wagenius serves as a deterrent to military personnel who might attempt to leverage their clearance or technical training for illicit gain. The case concludes with a clear message from the federal judiciary: the intersection of military access and cyber-extortion will be met with the full force of the law, regardless of the perpetrator’s intent or the success of their financial endeavors.