Cameron John Wagenius, a 22-year-old former U.S. Army soldier who operated under the chilling cybercriminal alias “Kiberphant0m,” has been sentenced to 70 months in federal prison following a landmark prosecution in a Seattle federal court. Wagenius, who held a secret security clearance while stationed in South Korea, pleaded guilty to multiple counts of computer fraud, identity theft, and extortion after orchestrating a sweeping international hacking campaign that targeted major telecommunications and cloud storage providers.
In addition to the nearly six-year prison sentence, United States District Judge ordered Wagenius to pay $294,978 in restitution to his victims. Prosecutors revealed that despite orchestrating breaches that compromised sensitive call and text metadata for more than 100 million AT&T customers—as well as targeting dozens of other global telecommunications giants—Wagenius reaped a meager profit of approximately $1,500 from his illicit operations. The case highlights a dangerous convergence of insider threats, cloud misconfigurations, and modern cybercriminal enterprises that leverage generative artificial intelligence and global forums to execute widespread digital extortion.
The Genesis of Kiberphant0m: Cloud Insecurity and Insider Threats
The investigation into Wagenius began in earnest when federal cybersecurity researchers and investigative journalists flagged suspicious activities on cybercrime forums. Operating from his military post in South Korea, Wagenius exploited a widespread vulnerability plaguing organizations utilizing cloud-based data storage service Snowflake. The vector for these breaches was fundamentally rooted in human error and inadequate security configurations: numerous enterprise accounts had failed to enforce multi-factor authentication (MFA) and relied on exposed, static credentials.
Working alongside a network of international co-conspirators, Kiberphant0m successfully exfiltrated vast repositories of enterprise data. By late 2024, the operation reached its peak when the threat actor publicly bragged on underground forums about compromising the call and text metadata of tens of millions of AT&T customers. This stolen metadata included detailed records of source and destination phone numbers, call durations, timestamps, and routing information.
Beyond AT&T, Kiberphant0m’s ambitions spanned across a dozen international telecommunications organizations, including Verizon’s specialized Push-to-Talk business. Armed with this sensitive data, the cybercriminal syndicate engaged in aggressive extortion campaigns, demanding substantial cryptocurrency payouts under the threat of leaking proprietary corporate information and sensitive consumer logs online.
A Chronology of Investigations, Arrests, and Guilty Pleas
The dismantling of the Kiberphant0m enterprise was the result of a coordinated, multi-agency federal task force involving the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the U.S. Department of Defense Office of Inspector General—alongside the Federal Bureau of Investigation (FBI), the Army Criminal Investigative Division (CID), and the U.S. Secret Service.
The timeline of the investigation and subsequent legal proceedings underscores the rapid escalation of modern cyber law enforcement:
- Late November 2024: Security researchers publish findings indicating that the mastermind behind the Snowflake-related telecommunications extortions, Kiberphant0m, is likely a U.S. soldier stationed overseas in South Korea.
- December 2024: Following intensive digital footprint analysis and intelligence sharing, federal agents arrest Cameron John Wagenius. He is formally charged in two separate federal indictments and quickly enters a guilty plea to all counts.
- August 2026: Canadian co-conspirator Conor Riley Moucka, known online as “Judische,” pleads guilty in connection to the Snowflake data theft operations after his 2024 arrest in Ontario.
- September 2025 – September 2026: While incarcerated and awaiting sentencing in a federal detention facility, Wagenius is caught attempting to manipulate prison computer policies, utilizing artificial intelligence prompts to research enterprise software vulnerabilities and prison escape tactics.
- Today: Wagenius receives his final sentencing of 70 months in federal prison and is ordered to pay nearly $300,000 in victim restitution during a hearing in Seattle.
Co-Conspirators and Global Network
Federal prosecutors emphasize that Wagenius did not operate in a vacuum. He was part of a decentralized, highly destructive cybercriminal network composed of actors with extensive digital footprints across North America and Europe.
Among his key associates was Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with a notorious history in the cybercrime underground. Schuchman previously pleaded guilty in 2019 to operating the Satori botnet—a massive, weaponized swarm of compromised Internet-of-Things (IoT) devices responsible for crippling distributed denial-of-service (DDoS) attacks worldwide. Prosecutors noted that Schuchman actively assisted Wagenius in coordinating and executing the corporate extortion demands.
Another primary co-conspirator, Conor Riley Moucka of Kitchener, Ontario, was arrested in Canada in 2024 and subsequently pleaded guilty in August 2026 for his role in the Snowflake-enabled data thefts. Meanwhile, a third alleged co-conspirator, American national John Erin Binns, remains a fugitive living in Turkey. Binns is separately wanted by U.S. authorities for his alleged involvement in the massive 2021 T-Mobile data breach, which compromised the personal information of at least 76 million customers.
Escalation, Double-Extortion, and National Security Threat
What elevated the Kiberphant0m case from a standard corporate extortion scheme to a premier national security priority was the syndicate’s volatile escalation tactics. After AT&T and associated victims had already paid an extortion group a reported $370,000 Bitcoin ransom, the threats intensified. Following Moucka’s arrest, Kiberphant0m engaged in re-extortion efforts. In an unprecedented move, the hacker posted datasets online that allegedly included the call logs of prominent political figures, including then-President-elect Donald Trump and then-Vice President Kamala Harris. Furthermore, the actor claimed to possess and threatened to publish classified schematics stolen from the U.S. National Security Agency (NSA).
Paul Russell, the resident agent in charge at the DCIS, highlighted the profound shock waves sent through the defense and intelligence communities upon discovering that an active-duty military member with secret clearance was directly engaged in cybercrime and data trafficking.
“We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell stated. “That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.”
Incarceration Misconduct and AI Prompt Injection Tactics
Even behind bars, Wagenius’s technical curiosity and intent to breach systems did not wane. According to a sentencing memorandum filed by federal prosecutors in Seattle, Wagenius violated Bureau of Prisons (BOP) computer use policies while awaiting sentencing. Inmates typically have limited, monitored access to electronic messaging systems; Wagenius exploited these channels to query commercial artificial intelligence tools via unwitting intermediaries.
In September 2025, using another inmate’s email account, Wagenius instructed a recipient to prompt an AI tool for specific Common Vulnerabilities and Exposures (CVEs) related to Windows 10 Enterprise privilege escalation, requesting real-world working scripts without omitted code. Shortly thereafter, he requested step-by-step instructions and exploit code for CVE-2023-45208, a command injection vulnerability affecting D-Link networking devices.
In another instance, Wagenius queried the AI system on how to construct a makeshift radio antenna using prison commissary items to extend radio reception, alongside inquiries concerning prison escape routes.
Government prosecutors noted that Wagenius frequently framed these malicious technical queries within the context of a fictional book he claimed to be writing. Cybersecurity experts recognize this technique as "prompt injection"—a sophisticated method where attackers craft deceptive inputs to bypass the safety guardrails of commercial AI tools designed to prevent the generation of actionable exploit code.
When confronted by federal investigators regarding these prison-era searches, Wagenius claimed he was merely researching potential vulnerabilities to provide security insights to the BOP. Prosecutors confirmed, however, that there is no evidence Wagenius successfully deployed or executed these exploits within the prison’s internal network infrastructure.
Broader Implications for Corporate Cybersecurity and Defense
The sentencing of Cameron John Wagenius serves as a critical case study for both military counterintelligence and enterprise cybersecurity architectures. The incident underscores several vital takeaways for the modern digital landscape:
- The Danger of Stale Credentials and Unenforced MFA: The initial breaches that enabled Kiberphant0m to access vast customer databases highlight that cloud storage providers and enterprise clients must treat multi-factor authentication as an absolute non-negotiable baseline. In the wake of these attacks, Snowflake and numerous other cloud vendors have aggressively mandated MFA across all accounts.
- The Insider Threat Paradigm: Defense and intelligence agencies are increasingly forced to adapt to tech-savvy personnel who possess both authorized security clearances and illicit technical capabilities. The collaboration between the DCIS, FBI, CID, and Secret Service demonstrates an evolving capability to rapidly identify and neutralize internal digital threats before catastrophic national security secrets are compromised.
- The Rise of AI Abuse in Detention: The attempts by Wagenius to leverage artificial intelligence for privilege escalation and network mapping while incarcerated illustrate the ubiquitous availability of technical knowledge. Threat actors no longer require vast offline libraries to weaponize software vulnerabilities; generative AI tools, when successfully manipulated through prompt engineering, can drastically lower the technical barrier to cybercrime.
Despite the massive scale of the data exfiltrated and the widespread public anxiety caused by the exposure of metadata belonging to over 100 million individuals, the financial outcome for the perpetrator was remarkably poor. Generating only $1,500 in direct profit from his criminal enterprise, Wagenius traded his military career, his freedom, and his future for a prolonged federal prison term—cementing Kiberphant0m’s legacy as a cautionary tale of unchecked digital ambition meeting the full force of international law enforcement.
