Main Facts

Cameron John Wagenius, a 22-year-old active-duty U.S. Army soldier stationed in South Korea, was sentenced in a Seattle federal courtroom to 70 months—nearly six years—in federal prison. Operating under the dark-web persona "Kiberphant0m," Wagenius orchestrated a sweeping international cybercrime campaign that compromised massive cloud storage databases, targeted major telecommunications providers, and leaked sensitive call metadata belonging to more than 100 million AT&T customers.

In addition to his prison term, U.S. District Judge ordered Wagenius to pay $294,978 in restitution to his victims. Despite holding a secret security clearance and possessing the technical sophistication to infiltrate networks spanning multiple continents, federal prosecutors revealed that Wagenius’s illicit enterprise yielded a meager $1,500 in direct financial profit—highlighting a staggering disconnect between the massive scale of destruction caused and the paltry monetary return.

Wagenius’s downfall is the result of a joint multi-agency federal investigation involving the Federal Bureau of Investigation (FBI), the Army Criminal Investigation Division (CID), the U.S. Secret Service, and the Defense Criminal Investigative Service (DCIS). Operating as an insider threat with high-level military access, Wagenius collaborated with an international syndicate of cybercriminals to exploit corporate vulnerabilities, execute corporate extortions, and even threaten national security by leaking classified intelligence.

Chronology of an Intrusion

The trail of digital destruction left by "Kiberphant0m" and his co-conspirators unfolded rapidly across late 2024, triggering a massive international law enforcement response.

• Early 2024: While stationed at a U.S. military installation in South Korea, Cameron Wagenius adopts the moniker "Kiberphant0m" and begins leveraging exposed credentials from cloud data storage service Snowflake. Because several major corporate clients failed to enforce multi-factor authentication (MFA)—a security oversight Snowflake has since rectified by mandating MFA across all accounts—Wagenius and his associates gain unauthorized entry.
• October 2024: Kiberphant0m takes to cybercrime forums to boast about his most catastrophic breach to date: stealing call and text metadata (including source numbers, destination numbers, timestamps, and durations) belonging to tens of millions of AT&T customers. He claims responsibility for hacking more than a dozen global telecommunications companies, including Verizon’s Push-to-Talk division, publicly extorting them under threat of data publication.
• Late November 2024: Security journalist Brian Krebs publishes an investigative report warning that the notorious hacker behind the Snowflake extortions is likely an active-duty U.S. soldier stationed in South Korea.
• December 2024: Following the public exposure, federal authorities arrest Wagenius. He is swiftly hit with two separate federal indictments and quickly pleads guilty to all counts.
• August 2026: Canadian co-conspirator Conor Riley Moucka (a.k.a. "Judische") pleads guilty in connection to the Snowflake data-theft extortion ring following his 2024 arrest in Ontario.
• September 2025 – September 2026: While incarcerated and awaiting sentencing at a federal facility, Wagenius attempts to exploit Bureau of Prisons (BOP) email systems to query commercial AI tools for Windows 10 privilege escalation exploits, D-Link router vulnerabilities, prison radio antenna construction, and escape tactics.
• Today: Wagenius receives his 70-month prison sentence in Seattle, bringing a definitive chapter to one of the most high-profile insider-threat cybercrime cases in recent U.S. military history.

Supporting Data and Technical Operations

The mechanics of the Kiberphant0m hacking ring relied heavily on credential harvesting and exploiting enterprise configuration flaws rather than sophisticated, zero-day malware attacks.

The primary vector for the enterprise was Snowflake, a widely used cloud data storage and analytics platform. In early 2024, Wagenius and his co-conspirators identified and targeted large corporate clients that had failed to mandate multi-factor authentication. By utilizing exposed administrative credentials, the threat actors bypassed perimeter defenses and exfiltrated vast repositories of enterprise data.

Among the victims was telecommunications giant AT&T, whose massive data breach exposed the call and text metadata of over 100 million customers. While the leaked files did not contain audio recordings or message content, the granular nature of the metadata—mapping out exact communication patterns, durations, and timestamps between individuals—posed profound privacy and surveillance risks.

Federal prosecutors and sentencing memos highlighted the broader network of individuals linked to Wagenius’s operations:

• Kenneth Schuchman: A 28-year-old resident of Vancouver, Washington, with a notorious background in cybercrime. In 2019, Schuchman pleaded guilty to operating the Satori botnet, a massive army of compromised Internet-of-Things (IoT) devices used to launch crippling distributed denial-of-service (DDoS) attacks. Schuchman allegedly assisted Wagenius in the extortion phases of the telecom hacks.
• Conor Riley Moucka ("Judische"): A Kitchener, Ontario resident arrested in 2024 who pleaded guilty in August 2026 for his integral role in the Snowflake extortion schemes.
• John Erin Binns: An American citizen currently residing in Turkey. Binns remains wanted by U.S. authorities not only for his involvement with the Snowflake extortion group but also for his suspected role in the massive 2021 T-Mobile data breach that exposed the personal records of at least 76 million customers.

The financial reality of the operation was remarkably stark. Despite commanding access to datasets valued in the millions of dollars on the black market, Wagenius’s direct monetary payout amounted to roughly $1,500. Even after the extortion group successfully coerced AT&T into paying a $370,000 Bitcoin ransom, internal disputes and immediate law enforcement interventions meant that the vast majority of the ill-gotten gains evaporated before enriching the perpetrators.

Desperate and cornered following the arrest of co-conspirator Moucka, Kiberphant0m attempted a dangerous secondary wave of re-extortion. He published what he claimed were AT&T call logs belonging to high-profile political figures—including then-President-elect Donald Trump and then-Vice President Kamala Harris—alongside technical schematics allegedly stolen from the U.S. National Security Agency (NSA).

Official Responses

The intersection of active-duty military service, high-level security clearances, and international cybercrime created a five-alarm fire within the U.S. Department of Defense and federal law enforcement agencies.

Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the Department of Defense Office of Inspector General—emphasized the unprecedented nature of the threat. When intelligence first indicated that an active-duty soldier with a secret clearance was actively constructing malware and trafficking in stolen enterprise data, DCIS immediately mobilized a joint task force with the FBI, the Army Criminal Investigation Division (CID), and the U.S. Secret Service.

"We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell remarked. "That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."

The gravity of Wagenius’s actions extended far beyond his initial guilty plea. According to a sentencing memorandum filed on September 19 by federal prosecutors in Seattle, Wagenius demonstrated a persistent, incorrigible compulsion to probe digital systems even while locked behind bars.

While incarcerated and awaiting his sentencing hearing, Wagenius exploited the email accounts of fellow inmates to trick commercial Artificial Intelligence tools. Recognizing that AI models are hardcoded with safety guardrails to prevent the generation of malicious exploit code, Wagenius utilized a deceptive technique known as "prompt injection." By framing his requests around a fictitious book he claimed to be writing, he prompted AI tools to generate actionable exploit information, including:

• Specific Common Vulnerabilities and Exposures (CVEs) for Windows 10 Enterprise privilege escalation and security bypasses.
• Real-world working scripts with un-omitted code for CVE-2023-45208, a critical command-injection vulnerability affecting D-Link networking hardware.
• Instructions on how to fabricate makeshift radio antennas using prison commissary items to extend reception frequencies.
• Direct tactical research into methods for escaping a correctional facility.

Federal prosecutors noted that while there is no evidence Wagenius successfully deployed these acquired vulnerabilities against the Bureau of Prisons’ infrastructure—and while Wagenius lamely claimed he was merely researching flaws to "provide information to the BOP"—the behavior underscored an acute, ongoing security risk posed by unrepentant cybercriminals embedded within government custody.

Implications

The sentencing of Cameron Wagenius marks a critical watershed moment for enterprise cybersecurity, military counter-intelligence, and the evolving intersection of generative artificial intelligence and insider threats.

First and foremost, the case exposes glaring vulnerabilities in cloud identity management. The entire Kiberphant0m enterprise hinged on weak corporate hygiene—specifically, the failure of major enterprises and cloud storage providers like Snowflake to universally enforce multi-factor authentication. While Snowflake and its corporate clients have since tightened authentication protocols, the incident serves as a brutal reminder that corporate networks are only as secure as their weakest administrative credential.

Second, the Wagenius case represents a profound nightmare scenario for military counterintelligence. The fusion of an active-duty service member holding a secret clearance with sophisticated underground cybercriminal networks shatters traditional boundaries of national security. The ease with which an insider could exfiltrate corporate metadata, weaponize state-adjacent vulnerabilities, and threaten the release of national security intelligence—such as NSA schematics and political communication logs—forces the Department of Defense to aggressively rethink its insider-threat monitoring protocols.

Finally, the revelations regarding Wagenius’s prison-house experimentation with artificial intelligence signal a dangerous new frontier in cybercrime. By utilizing prompt injection frameworks to bypass the ethical guardrails of commercial AI engines, threat actors—even those locked behind federal prison walls—can potentially crowdsource technical exploit scripts and zero-day research without possessing advanced programming expertise.

As Wagenius begins serving his nearly six-year federal sentence, the digital footprint of Kiberphant0m leaves behind a permanent scar on the telecommunications sector and an enduring warning to regulatory bodies, cloud providers, and military commanders alike: the modern cyber threat does not always come from across international borders; sometimes, it wears the uniform.