U.S. Army Soldier Sentenced to Prison for Massive Telecom Data Breach and Extortion Scheme

Cameron John Wagenius, a 22-year-old U.S. Army soldier formerly stationed in South Korea, was sentenced today in a Seattle federal courtroom to 70 months in prison. The sentencing marks the conclusion of a high-profile investigation into a cybercriminal operation that compromised the metadata of over 100 million AT&T customers and targeted numerous telecommunications companies worldwide. In addition to the six-year custodial sentence, Wagenius has been ordered to pay $294,978 in restitution to the victims of his digital exploits.

The case of Wagenius, who operated under the alias “Kiberphant0m,” provides a rare and unsettling glimpse into the intersection of military insider threats and global cybercriminal networks. Despite his secret security clearance and access to sensitive military infrastructure, Wagenius engaged in a sustained campaign of data theft and extortion that rattled the telecommunications industry and drew the immediate attention of the Department of Defense, the FBI, and the U.S. Secret Service.

The Anatomy of the Breach

The foundation of the criminal enterprise lay in the exploitation of unsecured credentials. Working in tandem with three alleged co-conspirators, Wagenius targeted several large enterprise clients of the cloud data storage provider Snowflake. The attackers identified accounts that had failed to implement multi-factor authentication (MFA), a critical security oversight that allowed the threat actors to bypass standard access controls.

Following the breach, the group exfiltrated vast amounts of data, most notably the call and text metadata of approximately 100 million AT&T customers. This metadata, while not containing the content of communications, included sensitive information such as source and destination phone numbers, timestamps, and the duration of calls. For law enforcement and intelligence agencies, the potential for this data to be used in pattern-of-life analysis—tracking the movements and associations of individuals—represented a significant national security concern.

Chronology of a Cybercriminal Campaign

The illicit activities of the Kiberphant0m collective unfolded over a volatile period of approximately two years:

• 2024: Wagenius and his co-conspirators systematically target Snowflake clients, exfiltrating massive datasets from telecommunications providers.
• October 2024: Wagenius publicly claims responsibility for the theft on underground cybercrime forums, boasting about his access to the metadata of tens of millions of AT&T customers. He begins a campaign of extortion against multiple global telecoms, including Verizon’s Push-to-Talk division.
• November 2024: Investigative reporting by KrebsOnSecurity establishes a probable link between the Kiberphant0m persona and a U.S. soldier stationed in South Korea.
• December 2024: Federal authorities arrest Wagenius. He is subsequently charged in two separate federal indictments.
• August 2026: Conor Riley Moucka, an associate of Wagenius, enters a guilty plea in connection with the Snowflake data thefts.
• September 2026: Federal prosecutors file a detailed sentencing memorandum, revealing that Wagenius continued his illicit research into system vulnerabilities even while in custody.
• Current Date: Wagenius receives his sentence of 70 months in federal prison.

The Co-conspirators and the Network

Wagenius did not operate in a vacuum. Federal prosecutors have highlighted his collaboration with Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with an established history in the cybercriminal underworld. Schuchman previously pleaded guilty in 2019 to his role in operating the Satori botnet, an expansive network of compromised Internet-of-Things (IoT) devices used to launch large-scale distributed denial-of-service (DDoS) attacks.

The international nature of the operation is underscored by the involvement of two other primary figures. Conor Riley Moucka, known by the alias “Judische,” was arrested and pleaded guilty in 2026. Simultaneously, John Erin Binns—an American citizen residing in Turkey—remains a subject of intense scrutiny. Binns is also a primary person of interest in the 2021 T-Mobile data breach, which compromised the personal information of at least 76 million individuals.

Official Responses and Internal Security Concerns

The discovery that an active-duty soldier with a secret clearance was at the heart of such a sophisticated hacking operation created an immediate crisis within the U.S. military’s intelligence and criminal investigative branches. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS), emphasized the rarity and gravity of the situation.

“We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell stated. “It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.”

The investigation involved a multi-agency task force, reflecting the seriousness of the breach. The potential for the stolen data to be leveraged against high-ranking government officials was highlighted when the extortionists leaked what they claimed were call logs for then President-elect Donald Trump and then Vice President Kamala Harris. These leaks occurred shortly after a $370,000 Bitcoin ransom was paid by AT&T, an act that failed to stop the subsequent release of the stolen data.

Unrepentant Conduct: The Prison Vulnerability Research

Perhaps the most startling aspect of the case was the behavior of Wagenius while awaiting sentencing. Despite his cooperation with investigators, government records indicate that Wagenius attempted to utilize the Bureau of Prisons (BOP) computer network to identify security vulnerabilities.

According to the sentencing memorandum, Wagenius used the email accounts of other inmates to query commercial AI tools. He employed a technique known as "prompt injection"—framing his requests as research for a book—to bypass safety filters. His queries specifically sought information on "Windows 10 Enterprise privilege escalation" and "command injection" vulnerabilities, specifically mentioning CVE-2023-45208, a known vulnerability in D-Link networking hardware. Furthermore, he sought information on constructing antennas to boost radio reception and even researched methods for escaping prison.

While prosecutors noted they had no evidence he successfully deployed these vulnerabilities within the BOP systems, the behavior suggested a persistent, compulsive need to engage in cyber exploitation.

Broader Implications and Industry Analysis

The case of Cameron Wagenius serves as a sobering case study in the vulnerability of modern cloud-based infrastructure. The success of the initial breach was rooted in the failure to enforce robust multi-factor authentication, a fundamental security practice that has since been mandated by providers like Snowflake.

Financially, the operation was ironically unsuccessful for the perpetrator. Despite the scale of the theft—which impacted 100 million people and caused profound reputational and operational damage to some of the world’s largest corporations—Wagenius reportedly netted only about $1,500 from his activities. This disparity between the massive potential harm and the meager financial gain highlights the irrationality often found in the modern cybercriminal landscape.

For the telecommunications industry, the fallout from this breach has resulted in increased scrutiny regarding the storage and protection of metadata. As data becomes the primary commodity of the digital age, the "insider threat" model—exemplified by a soldier with high-level access—presents a persistent challenge to national security. The sentencing of Wagenius closes the chapter on this specific operation, but it raises ongoing questions about the adequacy of security clearance vetting processes and the ease with which sophisticated actors can exploit gaps in enterprise security protocols. The Department of Justice remains committed to pursuing the remaining members of the conspiracy, with the global nature of the threat continuing to complicate international extradition and prosecution efforts.