SEATTLE — A federal judge in Seattle sentenced a 22-year-old former U.S. Army soldier to 70 months in federal prison today for orchestrating a sweeping cybercriminal campaign that compromised sensitive data from more than 100 million AT&T customers and targeted major global telecommunications infrastructure. Cameron John Wagenius, who operated under the alias "Kiberphant0m," was also ordered to pay $294,978 in restitution to victims following his guilty plea to federal hacking and extortion charges.

The sentencing brings a legal milestone to one of the most complex insider-threat and corporate extortion investigations in recent memory. Operating from a military base in South Korea while holding a secret security clearance, Wagenius exploited lax credential management at cloud data storage provider Snowflake, spearheaded a coordinated international extortion ring, and later attempted to leverage generative artificial intelligence to probe prison computer systems while awaiting trial.

Federal prosecutors emphasized that despite the monumental scale of the data he accessed—including call and text metadata for virtually the entire AT&T subscriber base—Wagenius’s criminal enterprise yielded a meager financial return of roughly $1,500. Yet, the chaos, reputational damage, and national security risks his actions generated prompted an unprecedented joint response from elite federal investigative agencies.

Chronology of an Insider Threat

The unraveling of the "Kiberphant0m" persona highlights how digital forensics, investigative journalism, and coordinated law enforcement can dismantle transnational cybercrime syndicates.

• Late 2023 to Early 2024: Organizations utilizing cloud storage provider Snowflake fail to enforce mandatory multi-factor authentication (MFA) on accounts with exposed credentials. Threat actors, including Wagenius and his co-conspirators, download massive repositories of corporate data.
• October 2024: Operating as "Kiberphant0m," Wagenius brazenly boasts on cybercrime forums about exfiltrating call and text metadata—such as source and destination numbers, timestamps, and call durations—belonging to tens of millions of AT&T customers. He claims to have compromised over a dozen international telecommunications companies, including Verizon’s Push-to-Talk division, initiating public extortion campaigns.
• Late November 2024: Cybersecurity publication KrebsOnSecurity publishes intelligence indicating that the individual behind the Kiberphant0m handle is likely an active-duty U.S. soldier stationed in South Korea.
• December 2024: Federal law enforcement acts swiftly. Wagenius is arrested, subsequently facing two separate federal indictments to which he rapidly pleads guilty.
• September 2025: While incarcerated and awaiting sentencing in a federal Bureau of Prisons (BOP) facility, Wagenius attempts to bypass facility restrictions. Utilizing other inmates’ email accounts, he manipulates commercial AI tools via "prompt injection" techniques to research Windows 10 privilege escalation exploits, D-Link vulnerabilities, and makeshift prison antenna construction.
• August 2026: Canadian co-conspirator Conor Riley Moucka (a.k.a. "Judische") pleads guilty in connection with the broader Snowflake extortion enterprise.
• Today: Wagenius is handed a 70-month prison sentence and nearly $300,000 in restitution during a hearing in Seattle.

The Co-Conspirator Network and Global Footprint

While Wagenius was the insider threat operating under the radar from a foreign military installation, federal prosecutors outline a broader network of seasoned cybercriminals who facilitated or participated in the extortion schemes.

According to the U.S. Department of Justice, Wagenius collaborated closely with Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, who possessed an extensive background in illicit cyber operations. Schuchman previously pleaded guilty in 2019 to orchestrating the infamous Satori botnet, a massive army of compromised Internet-of-Things (IoT) devices deployed for large-scale distributed denial-of-service (DDoS) attacks.

Other prominent figures tied to the Snowflake data exfiltration ecosystem include:

• Conor Riley Moucka ("Judische"): A resident of Kitchener, Ontario, arrested in 2024 and convicted in August 2026 for his role in the Snowflake extortions.
• John Erin Binns: An American national currently residing in Turkey, who remains a target of international law enforcement not only for his alleged involvement in the Snowflake incidents but also for his suspected connection to the massive 2021 T-Mobile data breach that exposed personal details of at least 76 million customers.

The extortion ring relied heavily on intimidation. Following AT&T’s initial payment of a $370,000 Bitcoin ransom to the group, Kiberphant0m engaged in "re-extortion" tactics. Frustrated by law enforcement pressure and the arrest of Moucka, Wagenius published data sets on hacker forums intended to maximize damage. These leaks included what he claimed were AT&T call logs for then-President-elect Donald Trump and then-Vice President Kamala Harris, alongside schematics allegedly stolen from the U.S. National Security Agency (NSA).

Official Responses and the Nature of the Threat

The revelation that an active-duty soldier with a secret security clearance was authoring hacking tools and trading in stolen corporate data sent shockwaves through the Department of Defense.

Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the U.S. Department of Defense Office of Inspector General—noted the extreme urgency that gripped federal agencies upon receiving the initial lead. DCIS launched a joint investigation alongside the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service.

"We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell stated. "That doesn’t happen every day, and so when that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."

Despite his technical aptitude and access to classified environments, prosecutors pointed out the stark irony of Wagenius’s criminal enterprise: despite possessing data of immense theoretical value, his direct proceeds from selling stolen information totaled a meager $1,500.

As noted in the government’s sentencing memorandum filed in U.S. District Court in Seattle, "While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government."

Implications: Artificial Intelligence, Prison Security, and Corporate Defense

The sentencing memo revealed alarming details regarding Wagenius’s behavior after his arrest, shedding light on the evolving challenges institutions face regarding incarcerated hackers and the misuse of generative artificial intelligence.

While detained in a Bureau of Prisons facility awaiting sentencing, Wagenius sought to test the boundaries of prison IT policies. Because inmates are typically barred from direct internet access, Wagenius covertly utilized the email accounts of fellow inmates to relay prompts to external commercial AI systems.

Aware that commercial AI models are hardcoded with safety guardrails to prevent the generation of malicious exploit code, Wagenius employed "prompt injection" strategies—framing his requests as background research for a fictional book he was writing. Through this method, he requested:

• Specific Common Vulnerabilities and Exposures (CVEs) related to Windows 10 Enterprise privilege escalation, accompanied by working, un-omitted exploit scripts.
• Step-by-step implementation details and exploit code for CVE-2023-45208, a critical command injection vulnerability affecting D-Link networking hardware.
• Instructions on constructing improvised radio antennas using commissary and prison-issued items to extend radio reception.
• Tactics and methodologies regarding prison escape planning.

While federal prosecutors confirmed there is no evidence that Wagenius successfully deployed these researched vulnerabilities against BOP networks—and Wagenius maintained he was merely auditing security to assist the bureau—the episode underscores the persistent risk posed by sophisticated threat actors even when physically restrained.

Industry Takeaways

1. Mandatory Multi-Factor Authentication (MFA): The Snowflake breaches that served as the foundational entry point for Wagenius and his co-conspirators underscore that zero-trust architectures and mandatory MFA are no longer optional best practices; they are absolute organizational necessities.
2. The Insider Threat Paradigm: The involvement of an active-duty soldier with security clearances demonstrates that modern cyber defense must extend beyond perimeter network security to encompass rigorous internal monitoring, behavioral analytics, and clearance vetting.
3. AI Governance and Guardrails: The exploitation of commercial generative AI tools via prompt injection techniques by an incarcerated individual highlights the dual-use nature of large language models and the ongoing necessity for AI providers to refine abuse-detection algorithms against sophisticated social engineering inputs.