U.S. Army Soldier Sentenced to Prison for Massive Telecommunications Data Theft and Global Extortion Campaign

A 22-year-old U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in federal prison following a high-stakes investigation into his role as a key orchestrator of a series of global cyberattacks and extortion schemes. Operating under the alias "Kiberphant0m," Wagenius, who was stationed in South Korea at the time of his activities, was convicted of compromising the data of over 100 million AT&T customers and targeting numerous international telecommunications firms. In addition to his prison term, Wagenius was ordered to pay nearly $300,000 in restitution to his victims, closing a chapter on one of the most significant insider-threat cybercrime cases in recent military history.

The Anatomy of the Breach and the Snowflake Exploitation

The core of the criminal enterprise revolved around the unauthorized access of accounts within Snowflake, a widely used cloud-based data storage platform. Wagenius and his co-conspirators exploited poor security hygiene at several large organizations that utilized the platform, specifically targeting accounts that lacked enforced multi-factor authentication (MFA). By obtaining exposed credentials, the group was able to bypass traditional perimeter defenses and gain deep access to proprietary databases.

While Snowflake has since mandated MFA across all customer accounts to mitigate such vulnerabilities, the damage inflicted by the Kiberphant0m group was already widespread. In October 2024, the group publicly boasted on underground forums about their success, claiming to have exfiltrated call and text metadata—including timestamps, call durations, and source/destination numbers—for tens of millions of AT&T subscribers. The breach was not limited to the United States; the group targeted over a dozen international telecommunications companies, including Verizon’s Push-to-Talk infrastructure, using the stolen information as leverage to extort companies with the threat of public data leaks.

A Chronology of Crime and Capture

The investigation into Wagenius represented a complex cross-agency effort involving the Federal Bureau of Investigation (FBI), the Army Criminal Investigative Division (CID), the U.S. Secret Service, and the Defense Criminal Investigative Service (DCIS).

• Late 2024: Wagenius begins his public extortion campaign, utilizing the alias Kiberphant0m.
• November 2025: Cybersecurity researcher Brian Krebs publishes findings suggesting the perpetrator behind the Snowflake extortion campaigns is a U.S. soldier based in South Korea.
• December 2025: Following the investigative leads, authorities arrest Wagenius. He is hit with two separate federal indictments.
• Early 2026: Wagenius pleads guilty to all counts, acknowledging his role in the breaches.
• August 2026: Conor Riley Moucka, an alleged co-conspirator, enters a guilty plea in Canada.
• September 2026: Federal prosecutors file a sentencing memorandum highlighting the defendant’s continued attempts to probe security vulnerabilities while in custody.
• Final Sentencing: Wagenius receives his 70-month sentence in a Seattle federal court.

The Co-Conspirators and the Global Cybercrime Network

The prosecution of Wagenius uncovered a broader ecosystem of digital criminality. He did not act in a vacuum but was aided by individuals with established histories in the cyber-underground. Among these is Kenneth Schuchman, a 28-year-old from Vancouver, Washington. Schuchman was already known to federal authorities for his 2019 conviction regarding the operation of the "Satori" botnet, which leveraged hacked Internet-of-Things (IoT) devices to facilitate massive distributed denial-of-service (DDoS) attacks.

Other figures in the network include Conor Riley Moucka (alias "Judische"), a Canadian national who pleaded guilty in 2026, and John Erin Binns, an American currently residing in Turkey. Binns remains a person of interest in multiple high-profile cases, including the 2021 T-Mobile data breach that compromised the personal details of 76 million individuals. The collaboration between these actors underscores the increasingly global and decentralized nature of modern cyber-extortion gangs.

National Security Implications

The severity of the sentencing was exacerbated by the nature of the data involved. Following the arrest of his associate, Moucka, and despite the fact that AT&T had already paid a $370,000 Bitcoin ransom, Wagenius escalated his tactics. He leaked information he claimed were call logs for high-ranking political figures, including then President-elect Donald Trump and then Vice President Kamala Harris. Furthermore, he claimed to possess stolen schematics belonging to the U.S. National Security Agency (NSA), creating an immediate national security crisis.

Paul Russell, the resident agent in charge at the DCIS, highlighted the unique danger presented by this case. "We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell noted. The involvement of an "insider threat" with high-level clearance triggered an immediate, high-priority response from federal partner agencies, as the potential for the exposure of sensitive government information remained a major concern throughout the investigation.

Continued Malfeasance Behind Bars

Perhaps the most striking aspect of the government’s sentencing memorandum was the revelation that Wagenius continued to engage in illicit behavior even after his arrest. While awaiting sentencing in a Bureau of Prisons (BOP) facility, Wagenius attempted to utilize the internal email system of other inmates to query commercial AI tools about computer system vulnerabilities.

The sentencing memo details that in September 2025, Wagenius used these accounts to request "real-world working scripts" for Windows 10 privilege escalation and instructions for exploiting a D-Link networking device vulnerability (CVE-2023-45208). Additionally, he sought guidance on constructing improvised radio antennas and researched methods for escaping prison. Prosecutors noted that Wagenius employed "prompt injection" techniques—a method of bypassing AI safety guardrails by framing malicious requests as creative writing or academic research—to extract sensitive information. While there is no evidence he successfully deployed these vulnerabilities within the BOP network, the attempt demonstrated a persistent intent to circumvent security protocols.

Analysis: The "Unsuccessful" Extortionist

Despite the immense scale of the data breaches and the high-profile nature of his targets, the prosecution highlighted a paradoxical element of the case: the financial failure of the endeavor. According to the sentencing memo, Wagenius earned only approximately $1,500 from the sale of the stolen data. This discrepancy between the massive potential value of the data and the meager financial return serves as a reminder of the chaotic and often amateurish nature of modern digital extortionists, even those with technical sophistication.

However, the government emphasized that financial gain is not the only metric for assessing the severity of cybercrime. "While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government," the memorandum concluded.

Broader Implications for Corporate and Military Security

The case of Cameron Wagenius serves as a cautionary tale for both the private sector and the military. For corporations, the incident highlights the catastrophic risks of failing to implement mandatory multi-factor authentication. Even the most robust cloud infrastructure can be rendered useless if individual user credentials are not protected by secondary layers of verification.

For the Department of Defense, the case illustrates the ongoing challenge of mitigating the "insider threat." The ability of a single individual with legitimate security clearances to pivot from military duties to global cyber-extortion highlights gaps in monitoring and behavioral analysis for personnel with access to sensitive systems. As cyber-warfare and traditional military service continue to intersect, the integration of rigorous digital surveillance into the standard personnel security process will likely become a permanent necessity for the armed forces.

The 70-month sentence, while significant, also serves as a warning that the U.S. government is increasingly willing to treat cyber-extortionists with the same severity as physical threats, particularly when those threats originate from within the ranks of those sworn to protect the nation. As this case concludes, the focus now shifts toward the ongoing efforts to secure the victims’ data and the continued prosecution of the remaining members of the Kiberphant0m network.