A U.S. Army soldier who leveraged his position to orchestrate a sophisticated cyber-extortion campaign against major telecommunications providers—most notably compromising the metadata of over 100 million AT&T customers—was sentenced to 70 months in federal prison today. The sentencing marks the conclusion of a high-profile investigation into a series of breaches that rattled the foundations of digital privacy and national security.
Cameron John Wagenius, a 22-year-old soldier who was stationed at a U.S. military base in South Korea at the time of his crimes, operated under the online alias "Kiberphant0m." In addition to his prison term, a federal judge ordered Wagenius to pay $294,978 in restitution to the victims of his digital exploits.
The case, which involved a complex network of international co-conspirators and the exploitation of cloud-based data storage, became a top priority for federal authorities due to the unique nature of the perpetrator. Because Wagenius held a secret security clearance, the investigation—led by the Defense Criminal Investigative Service (DCIS) in conjunction with the FBI, the U.S. Army Criminal Investigative Division (CID), and the Secret Service—moved with urgent intensity.
Paul Russell, a resident agent in charge at the DCIS, highlighted the gravity of the situation, noting that the agency rarely encounters active-duty personnel who simultaneously possess top-tier military clearance and the technical capability to traffic in stolen national data. "That doesn’t happen every day," Russell stated. "When that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
The Rise and Fall of Kiberphant0m
Wagenius’s criminal activities centered on the exploitation of the cloud data storage service Snowflake. According to federal indictments, Wagenius and his associates targeted large customers of the platform that had failed to secure their accounts with multi-factor authentication (MFA). By utilizing exposed credentials, the group was able to gain unauthorized access to vast troves of sensitive data. Snowflake has since mandated the use of MFA across all accounts to prevent similar incidents.
By October 2024, the "Kiberphant0m" persona had become a fixture on various cybercrime forums, where Wagenius began boasting about his illicit achievements. He claimed to have successfully infiltrated more than a dozen telecommunications companies globally, including the Push-to-Talk business unit of Verizon. His strategy was one of digital terror: he would steal massive volumes of call and text metadata—including source and destination phone numbers, timestamps, and call durations—and then publicly extort the companies, threatening to release the information unless a ransom was paid.
The digital trail left by the hacker caught the attention of security researchers. In late November 2024, KrebsOnSecurity published an analysis suggesting that the individual behind the Kiberphant0m alias was likely a U.S. soldier stationed in South Korea. Less than a month later, federal authorities apprehended Wagenius. He was charged in two separate federal indictments and eventually pleaded guilty to all counts, acknowledging his role in the breaches.
A Network of Co-Conspirators
The prosecution of Wagenius revealed a broader ecosystem of cybercriminals. Federal investigators identified Kenneth Schuchman, a 28-year-old from Vancouver, Washington, as a key accomplice. Schuchman was already known to law enforcement for his history of digital crime, having pleaded guilty in 2019 to operating the Satori botnet, a massive infrastructure of compromised Internet-of-Things (IoT) devices used to launch large-scale distributed denial-of-service (DDoS) attacks.
Two other individuals were also implicated in the Snowflake-related data thefts. Conor Riley Moucka, an Ontario resident known online as "Judische," was arrested in 2024 and entered a guilty plea in August 2026. Another associate, John Erin Binns, an American citizen currently residing in Turkey, remains linked to the scheme and is separately wanted in connection with a massive 2021 T-Mobile data breach that exposed the personal information of at least 76 million customers.
Escalation and National Security Risks
As the extortion efforts faced pressure from law enforcement, the tactics employed by the group grew increasingly desperate. Following the arrest of Moucka—and despite the fact that AT&T had already paid the extortionists a ransom of $370,000 in Bitcoin—the Kiberphant0m persona turned toward more brazen threats. Wagenius began posting what he claimed were private call logs belonging to high-profile political figures, including then-President-elect Donald Trump and then-Vice President Kamala Harris. He also alleged that he possessed classified schematics stolen from the U.S. National Security Agency (NSA).
The willingness to leverage national security secrets for extortion underscored the danger posed by an individual with military clearance who had effectively turned against his own government.
Persistence of Criminal Intent
Even while in custody awaiting sentencing, Wagenius demonstrated an inability to step away from his cyber-obsessions. A sentencing memo filed by federal prosecutors in Seattle on September 19 revealed that Wagenius had attempted to probe the computer network of the Bureau of Prisons (BOP).
According to the memo, Wagenius used the email accounts of other inmates to interact with commercial AI tools, attempting to circumvent their safety guardrails through "prompt injection." In one instance, he requested information on vulnerabilities in Windows 10 Enterprise, specifically asking for "real world working scripts" for privilege escalation. In another, he sought step-by-step instructions for exploiting a known command injection vulnerability in D-Link networking devices.
Beyond his attempts to compromise computer systems, the sentencing memo noted that Wagenius had also requested information on how to construct an antenna using commissary items to improve radio reception, as well as inquiries related to prison escape. When confronted by authorities, Wagenius claimed he was merely researching these vulnerabilities to assist the BOP in improving their security posture. The government noted there was no evidence that he successfully deployed any of the exploits he researched.
A Disproportionate Outcome
Despite the sheer scale of the data he compromised and the significant resources required by federal agencies to track him down, the financial success of Wagenius’s campaign was remarkably limited. Federal investigators concluded that, in total, the soldier-turned-hacker earned only about $1,500 from his illicit efforts.
The sentencing memo offered a stark summary of his criminal career, noting, "While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government."
As he begins his 70-month sentence, the case serves as a sobering reminder of the potential for insider threats in the digital age. The collaboration between the DCIS, the FBI, and other agencies not only brought a prolific hacker to justice but also highlighted the critical necessity of securing cloud infrastructure and maintaining rigorous oversight of personnel with access to sensitive systems. For now, the "Kiberphant0m" persona has been effectively silenced, and the legal repercussions for his actions have finally caught up to his digital ambitions.
