U.S. Army Soldier Sentenced to Prison for Massive Telecommunications Data Breach and Extortion Scheme

Cameron John Wagenius, a 22-year-old active-duty U.S. Army soldier, has been sentenced to 70 months in federal prison following a complex investigation into a global cybercrime campaign that compromised the private metadata of over 100 million AT&T customers. Beyond his incarceration, Wagenius—who operated under the alias “Kiberphant0m”—has been ordered to pay approximately $294,978 in restitution. The sentencing, which took place in a Seattle federal courtroom, marks the conclusion of a high-profile case that exposed severe vulnerabilities in cloud-based data storage and highlighted the growing threat of insider actors within the military ranks.

The Rise and Fall of Kiberphant0m

Wagenius, while stationed at a U.S. military installation in South Korea, orchestrated a digital campaign that targeted some of the world’s largest telecommunications companies. His modus operandi centered on exploiting misconfigured or poorly secured credentials associated with Snowflake, a prominent cloud data storage provider. By leveraging compromised accounts that lacked mandatory multi-factor authentication (MFA), Wagenius and a network of international co-conspirators were able to siphon massive volumes of sensitive telecommunications metadata.

The breach was not merely a passive data theft; it was a brazen extortion operation. In late 2024, Wagenius began publicizing his illicit gains on various underground cybercrime forums, boasting that he possessed call and text logs for millions of subscribers. His reach extended far beyond AT&T, reportedly impacting more than a dozen major telecom providers globally, including segments of Verizon’s business infrastructure.

The investigation into Wagenius accelerated in November 2024, when cybersecurity journalist Brian Krebs identified a correlation between the “Kiberphant0m” persona and a U.S. soldier based in South Korea. This intelligence provided a critical breakthrough for federal authorities, leading to his arrest less than a month later. By the time he appeared in court, Wagenius faced multiple federal indictments, to which he pleaded guilty.

Chronology of the Criminal Enterprise

The timeline of the Kiberphant0m operation reveals a rapid escalation in ambition and recklessness:

• 2024: Wagenius begins systematically targeting Snowflake cloud environments that lack robust security protocols, harvesting metadata—including timestamps, durations, and source/destination numbers—for over 100 million AT&T customers.
• October 2024: The attacker publicly posts evidence of the breach on dark web forums, initiating extortion attempts against major telecom firms.
• November 2024: Investigative reporting links the cybercriminal activity to a specific U.S. soldier in South Korea.
• December 2024: Federal agents arrest Wagenius; he is formally charged in two separate indictments.
• 2025–2026: Throughout his pretrial period, Wagenius demonstrates a persistent pattern of behavior, attempting to probe the Bureau of Prisons’ (BOP) network security from behind bars.
• August 2026: Co-conspirator Conor Riley Moucka, also known as "Judische," enters a guilty plea in a related case.
• September 2026: Final sentencing documents are filed, detailing not only the original data thefts but also the defendant’s attempts to utilize AI tools to research prison network vulnerabilities.

The Co-Conspirator Network

Wagenius did not act alone. Prosecutors revealed that his operation was bolstered by a web of established cybercriminals. Among his primary associates was Kenneth Schuchman, a 28-year-old from Vancouver, Washington, with a documented history of large-scale digital malice. Schuchman previously pleaded guilty in 2019 for his role in operating the "Satori" botnet, which utilized compromised Internet-of-Things (IoT) devices to launch devastating distributed denial-of-service (DDoS) attacks.

Other figures in the case include Conor Riley Moucka, an Ontario resident who served as a key player in the Snowflake-related data thefts, and John Erin Binns, an American national residing in Turkey. Binns remains a significant figure in federal law enforcement crosshairs, as he is also linked to a massive 2021 T-Mobile data breach that affected at least 76 million individuals.

Institutional Challenges: The Insider Threat

The involvement of a soldier with a secret clearance created a unique and high-stakes challenge for the Department of Defense and federal intelligence agencies. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS), emphasized the rarity and gravity of the situation.

“We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell noted. The agency’s involvement was immediate, triggering a multi-agency task force involving the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service. The potential for the leak of classified intelligence, combined with the fact that the perpetrator possessed high-level security access, turned the case into a top-priority national security concern.

Persistent Malice: The Prison Exploitation Attempts

Perhaps the most startling aspect of the sentencing memo filed by federal prosecutors is the evidence that Wagenius continued to seek out security vulnerabilities even while in custody. The document describes a sophisticated, if ultimately unsuccessful, attempt to leverage generative AI tools to facilitate further cyber-attacks.

Using the accounts of other inmates, Wagenius reportedly sent prompts to AI systems asking for instructions on privilege escalation, Windows 10 enterprise bypasses, and even methods for constructing makeshift antennas to extend radio reception within the prison environment. To bypass the safety guardrails programmed into these AI tools, Wagenius employed "prompt injection" techniques, framing his requests as research for a book he claimed to be writing.

While the government noted that there is no evidence he successfully deployed these vulnerabilities against BOP systems, the behavior underscores a compulsive desire to exploit digital infrastructure, regardless of his physical confinement.

Broader Implications for Cybersecurity

The Kiberphant0m case serves as a stark reminder of the "weakest link" doctrine in cybersecurity. Despite the immense potential value of the data stolen—which included metadata for high-profile figures such as then President-elect Donald Trump and then Vice President Kamala Harris—the financial yield for the attackers was surprisingly low. Prosecutors noted that Wagenius earned only about $1,500 from the venture.

The discrepancy between the massive scale of the data breach and the negligible financial gain highlights a shift in modern cybercrime. Attackers are increasingly driven by the capability to cause widespread disruption and the notoriety gained through extortion, rather than solely by immediate monetary profit.

Furthermore, the case has prompted a serious reassessment of cloud security practices. The fact that the entire operation was predicated on the absence of multi-factor authentication has forced enterprises, including Snowflake, to mandate MFA across all customer accounts. This event has also ignited a broader conversation within the Department of Defense regarding the monitoring of "insider threats"—individuals who, by virtue of their position, have the trust and technical access to potentially compromise national interests from the inside.

Conclusion

The sentencing of Cameron John Wagenius provides a measure of justice for the millions of consumers affected by his actions, yet it also leaves behind lingering questions about the intersection of artificial intelligence, criminal intent, and institutional security. As the U.S. government continues to prosecute the remaining co-conspirators, the case of Kiberphant0m will likely remain a landmark study in how modern, decentralized cyber-threats can manifest within the most sensitive sectors of government and industry. For the tech sector, the lesson is clear: in an era of automated, AI-driven reconnaissance, even the most basic security protocols, such as multi-factor authentication, are the essential bedrock of digital defense.