WASHINGTON — In a landmark sentencing that underscores the growing intersection of insider threats and sophisticated international cybercrime, a former U.S. Army soldier was sentenced on Friday to 70 months in federal prison. Cameron John Wagenius, 22, orchestrated a sweeping campaign of cyberattacks, cloud compromises, and extortion schemes—conducted in part from his military barracks in Texas—targeting major global enterprises, including telecom giant AT&T.

The sentencing, announced by the Department of Justice, brings a measure of closure to one of the most destructive and far-reaching corporate cyber extortion sprees of 2024. Operating under online monikers such as "kiberphant0m" and "cyb3rph4nt0m," Wagenius not only amassed millions of dollars in illicit proceeds and compromised billions of sensitive consumer records, but he also attempted to peddle stolen national security data to a foreign intelligence service as his criminal network began to unravel.

Main Facts of the Case

Cameron John Wagenius’s criminal enterprise was defined by audacity, technical proficiency, and a profound betrayal of his oath of service. While stationed on active duty at Fort Cavazos (formerly Fort Hood) in Texas, Wagenius utilized specialized custom tools—including a credential-harvesting utility known as "SSH Brute" that he helped develop—to infiltrate cloud environments and corporate databases.

Working alongside an international network of co-conspirators, Wagenius targeted more than 10 major organizations globally. Among them were household names such as AT&T, Ticketmaster, Advance Auto Parts, and financial services provider Santander.

The primary vector for these breaches was the widespread compromise of Snowflake cloud customer environments. Wagenius and his associates harvested vast troves of proprietary data, intellectual property, and personal identifiable information (PII), subsequently turning around to demand multimillion-dollar ransoms under the threat of public data leaks.

In total, Wagenius and his co-conspirators accumulated more than $2.5 million in extortion payments. Beyond financial motives, federal prosecutors noted that Wagenius was heavily driven by a desire to cement his reputation and achieve elite status within underground cybercrime forums. As part of his plea deal finalized in July 2025, Wagenius was ordered to pay nearly $295,000 in direct restitution.

Chronology of an Escalating Cyber Spree

The trajectory of Wagenius’s cybercrime campaign highlights how rapidly a digital threat actor can escalate from low-level credential stuffing to threatening critical national infrastructure and major corporations.

• 2023–2024 (Active Duty Operations): While serving as an active-duty soldier in the U.S. Army, Wagenius begins utilizing military computing infrastructure and custom scripts to compromise cloud platforms, systematically building a massive repository of stolen corporate credentials and identity documents.
• April 2024 (The Snowflake Compromise): Wagenius and co-conspirators, including Canadian national Connor Moucka, orchestrate the massive exploitation of Snowflake customer databases. The attack ultimately impacts as many as 165 corporate environments, exposing billions of records.
• Mid-2024 (The AT&T Extortion Campaign): Wagenius targets AT&T, attempting to extort $500,000. As leverage, he leaks non-content call detail records (CDRs)—including phone and text logs belonging to high-profile individuals, such as Donald Trump and family members of former government officials.
• December 2024 (Federal Arrest): Federal law enforcement agencies execute search warrants, seizing Wagenius’s electronic devices at Fort Cavazos. Investigators discover thousands of stolen identification documents, substantial cryptocurrency holdings, and communications indicating a desire to defect to Russia and sell classified or sensitive data to foreign intelligence agencies.
• Post-Arrest Defiance (December 2024): In direct violation of orders from his commanding officer, Wagenius purchases a new laptop. Over a five-day period inside his barracks, he actively uses virtual private network (VPN) software to hide his digital footprint while attempting to cover his tracks.
• March 2025 (Extradition): Co-conspirator Connor Moucka is extradited from Canada to the United States to face federal charges related to the Snowflake attack spree.
• July 2025: Cameron Wagenius formally pleads guilty in federal court to multiple counts of computer fraud, extortion, and data theft.
• August 2025: Connor Moucka pleads guilty to his central role in the sprawling enterprise.
• September 2026: Wagenius is formally sentenced to 70 months in federal prison by the U.S. District Court for the Western District of Washington.

Supporting Data and Technical Scope

The scale of the Wagenius-Moucka conspiracy places it among the most disruptive supply-chain and cloud-security incidents in recent corporate history. According to cybersecurity research firms like Mandiant and Unit 221B, the attacks leverage compromised third-party cloud analytics platforms rather than traditional malware vectors, catching many organizations off guard.

• 165+: The estimated number of corporate environments compromised via the Snowflake-related attack vectors orchestrated by Wagenius, Moucka, and third co-conspirator John Erin Binns (who remains at large outside U.S. custody).
• Billions: The aggregate number of sensitive consumer and corporate records stolen during the spree.
• $2.5 Million: The combined total of extortion payments funneled to the core members of the hacking syndicate.
• $500,000: The specific ransom demand levied against AT&T by Wagenius, which he attempted to enforce by publicizing stolen call detail records.
• $295,000: The mandatory restitution ordered specifically against Wagenius at his September 2026 sentencing hearing.

Cybersecurity analysts noted that the operational security (OPSEC) maintained by the group relied heavily on obfuscation tools, credential reuse, and exploiting lax multi-factor authentication (MFA) policies within corporate cloud tenants. Despite these measures, digital forensics teams and federal law enforcement were able to trace the breadcrumbs back to Wagenius’s digital infrastructure.

Official Responses and Department of Justice Statements

The involvement of an active-duty U.S. military service member in a transnational cyber extortion ring drew sharp rebukes from senior law enforcement and judicial officials, who emphasized both the betrayal of public trust and the severe legal ramifications.

"Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign," said A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, in a public statement following the sentencing.

The financial and ego-driven motivations of the young soldier were a focal point for prosecutors, who argued that deterrence must serve as the primary objective of the court’s judgment.

"His hacking schemes were not only aimed at getting rich, he was also motivated by a desire to achieve status within criminal hacking communities," noted Charles Neil Floyd, first assistant attorney for the U.S. District Court for the Western District of Washington. "This sentence must impose real consequences to deter him, and hopefully other would-be hackers."

Law enforcement leadership expressed deep concern over the brazenness of Wagenius’s actions while wearing the uniform, particularly given his attempts to leverage foreign intelligence entities as his grip on the operation slipped.

"It is especially shocking that a member of our armed forces, sworn to defend Americans and their constitutional rights, would engage in such a violation of privacy," stated W. Mike Herrington, special agent in charge of the FBI Seattle field office.

Broader Implications for National Security and Cloud Security

The case of United States v. Wagenius transcends a standard corporate extortion prosecution, highlighting vulnerabilities that stretch across national security, military counterintelligence, and enterprise cloud architecture.

1. Insider Threats in the Digital Age

Traditionally, military insider threats involving espionage focused on physical documents, USB drives, or direct communication with foreign agents. Wagenius’s case demonstrates how modern digital infrastructure allows an individual service member to leverage advanced technical skills from a barracks room to wage economic warfare against Fortune 500 companies. The fact that Wagenius actively sought to defect to Russia and barter stolen data with foreign intelligence operatives transforms what began as a financial cybercrime spree into a pressing counterintelligence concern.

2. The Fragility of Third-Party Cloud Environments

The exploitation of platforms like Snowflake exposed a fundamental blind spot in modern enterprise security: companies can secure their own perimeters, but if a third-party cloud vendor or analytics partner suffers a credential compromise, downstream customers are instantly exposed. The leak of AT&T’s call detail records—affecting virtually all of its subscriber base—proved that even telecommunications giants are vulnerable to credential-stuffing attacks executed by agile, distributed threat groups.

3. Cross-Border Law Enforcement Cooperation

The successful dismantling of the Wagenius-Moucka network highlights the efficacy of international law enforcement coordination. By tracking threat actors across digital forums, cryptocurrency transactions, and physical borders—culminating in Moucka’s extradition from Canada—western intelligence and judicial agencies have signaled that geopolitical boundaries will offer diminishing refuge to cyber extortionists.

As the legal proceedings against Wagenius conclude with his 70-month prison term, federal agencies continue to track co-conspirator John Erin Binns, who remains outside U.S. custody. Meanwhile, the Department of Defense and enterprise security teams are left re-evaluating how to monitor digital access for personnel who possess both specialized technical aptitude and access to sensitive military networks.