By Suro Senen 
By Global Cybersecurity Desk
Published: August 2025
Main Facts
Connor Riley Moucka, a 26-year-old software engineer hailing from Kitchener, Ontario, has formally entered a guilty plea to a battery of federal charges, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. Once flagged by international threat intelligence agencies as one of the most consequential cybercrime actors of 2024, Moucka admitted to his central role in an unprecedented hacking and extortion campaign that targeted more than 165 major organizations utilizing cloud storage giant Snowflake.
Furthermore, Moucka confessed to orchestrating the massive theft of call and text history records belonging to more than 100 million AT&T customers. Operating under a rotating series of aliases—most prominently “Judische” and “Waifu”—Moucka and an elite cell of co-conspirators systematically exploited vulnerable cloud infrastructure, exfiltrating terabytes of proprietary and personally identifiable information (PII).
According to the U.S. Department of Justice (DOJ), the group’s digital pillaging impacted household brands such as TicketMaster, LendingTree, Advance Auto Parts, and Neiman Marcus. The attacks exposed an array of ultra-sensitive data, including Social Security numbers, driver’s licenses, passport numbers, banking details, payroll records, and Drug Enforcement Administration (DEA) registration numbers.
Moucka now faces a maximum penalty of up to 30 years in federal prison for the primary charges, alongside a mandatory, consecutive minimum sentence of two years for aggravated identity theft. His sentencing is scheduled for October 27.
Chronology of an International Cyber Campaign
The unraveling of Moucka’s cybercriminal empire spans several years of escalating digital intrusion, investigative breakthroughs, and high-profile arrests.
Phase 1: Early Operations and Voice Phishing (2020–2023)
Long before capturing global headlines for the Snowflake breaches, Moucka operated within elite, English-speaking Western cybercrime circles. Investigators linked his primary alias, "Judische," to extensive data breaches and sophisticated voice-phishing (vishing) campaigns targeting U.S. enterprises starting as early as 2020. During this period, Moucka cultivated technical expertise and established vital connections within underground forums, bridging the gap between traditional financial cybercrime and extremist networks known for harassing and extorting minors.
Phase 2: The Snowflake Onslaught and Extortion Spree (February–October 2024)
Between February and October 2024, Moucka and his co-conspirators executed a large-scale campaign targeting companies utilizing the Snowflake cloud data platform. By leveraging compromised login credentials purchased or stolen from third-party sources, the hackers accessed accounts that lacked multi-factor authentication (MFA). They downloaded terabytes of sensitive data and launched a systematic extortion campaign, demanding multi-million-dollar ransoms under the threat of public data leaks.
Investigators noted that Moucka’s ruthlessness extended beyond corporate entities. As law enforcement and cybersecurity researchers closed in, Moucka actively harassed and threatened government officials and security analysts. In a particularly brazen move, he re-extorted a victim by using the stolen data of a former government officer and members of that officer’s immediate family.
Phase 3: Exposing the Inner Circle and Arrests (September–November 2024)
- September 2024: Investigative journalist Brian Krebs (KrebsOnSecurity) published a landmark report unmasking "Judische" as an Ontario-based software engineer with deep ties to cyber-extortion rings.
- October 21, 2024: Canadian authorities captured a rare surveillance photo of Moucka, just nine days before his eventual apprehension.
- October 30, 2024: Acting on a provisional arrest warrant issued by the United States, the Royal Canadian Mounted Police (RCMP) arrested Moucka in Ontario.
- November 2024: Investigative reports tied U.S. Army soldier Cameron Wagenius (known as "Kiberphant0m") to the conspiracy. Following Moucka’s arrest, Wagenius attempted to exert leverage by posting purported call logs of high-profile political figures on hacker forums.
Phase 4: Guilty Pleas and Legal Reckoning (July 2025–Present)
In July 2025, co-conspirator Cameron Wagenius formally pleaded guilty to his role in the hacking and extortion scheme, setting a sentencing date of September 3, 2026. With Moucka’s recent guilty plea in August 2025 and an October sentencing date on the horizon, the core leadership of one of the decade’s most destructive cyber syndicates has effectively dismantled.
Supporting Data and Technical Overview
The scale of the Snowflake and AT&T breaches illustrates systemic vulnerabilities in modern enterprise cloud architectures.
- Victim Count: At least 165 enterprise customers utilizing Snowflake’s cloud storage environment were directly compromised.
- Data Volume: Billions of sensitive records, amounting to terabytes of data, were systematically exfiltrated.
- Exposed Information Types:
- Non-content call and text history records (affecting over 100 million AT&T customers).
- Banking, financial, and payroll information.
- Government-issued identification, including Social Security numbers, driver’s licenses, and passport numbers.
- Professional credentials, such as DEA registration numbers.
- Financial Extortion Yields: DOJ filings confirm that the conspirators successfully extorted over $2.5 million in ransom payments from corporate victims before law enforcement intervened.
The Co-Conspirators: Wagenius and Binns
The U.S. government’s indictment highlights two primary co-conspirators who operated alongside Moucka:
- Cameron “Kiberphant0m” Wagenius: A U.S. Army soldier stationed in South Korea, Wagenius managed various Telegram and Discord personas to coordinate extortion schemes targeting telecom giants AT&T and Verizon. Following Moucka’s arrest, Wagenius attempted to intimidate investigators by leaking unverified data purporting to belong to political figures, including Donald Trump and Kamala Harris, alongside stolen National Security Agency (NSA) schematics. He faces up to 25 years plus mandatory consecutive time.
- John Erin Binns (a.k.a. “IRDev,” “IntelSecrets”): A 26-year-old American fugitive previously indicted for a massive 2021 T-Mobile data breach affecting 76 million customers. Intelligence sources indicate that Binns recently secured Turkish citizenship. Under Turkish legal protections, citizens cannot be extradited to foreign jurisdictions, allowing Binns to remain largely insulated from U.S. prosecution despite resurfacing online.
Official Responses
Law enforcement and corporate entities have responded forcefully to the fallout from the Moucka-Wagenius conspiracy.
U.S. Department of Justice Statement:
In official press releases, the DOJ emphasized the severe threat posed by transnational cyber syndicates that weaponize stolen corporate data. Prosecutors underscored that Moucka’s willingness to target individual government officials and their families crossed a dangerous line, transforming corporate extortion into direct harassment of public servants.
Snowflake’s Remediation Efforts:
In the wake of the attacks, Snowflake issued comprehensive security updates. The company categorically denied that its core database infrastructure was breached directly, clarifying instead that attackers exploited poor hygiene practices among customer accounts—specifically the failure to enforce mandatory multi-factor authentication (MFA) combined with reused credentials. In response, Snowflake overhauled its platform security policies, permanently raising password complexity standards and making MFA enforcement mandatory across all customer instances.
AT&T and Enterprise Reactions:
Telecom provider AT&T cooperated extensively with federal agencies following the exfiltration of its customers’ call and text logs. Affected enterprises engaged specialized digital forensics firms to manage fallout, communicate with regulators, and navigate complex class-action litigation arising from the public exposure of consumer PII.
Implications for Global Cybersecurity
The guilty plea of Connor Riley Moucka marks a watershed moment in the intersection of cloud security, corporate accountability, and international law enforcement. Several critical takeaways define the post-Moucka cybersecurity landscape:
1. The Perils of Misconfigured Cloud Infrastructure
The Snowflake incidents demonstrated that even the most secure enterprise-grade cloud environments can be compromised if end-users fail to implement basic hygiene controls. The reliance on single-factor authentication remains an open door for sophisticated threat actors. Organizations have been forced to reevaluate their zero-trust frameworks, ensuring that credential management policies are strictly enforced across third-party software-as-a-service (SaaS) deployments.
2. The Fusion of Extortion and Personal Harassment
Moucka and his co-conspirators represented a disturbing evolution in cybercrime: the weaponization of personal data against private citizens and public officials. By extending extortion tactics to target the family members of investigators and government personnel, the actors crossed traditional boundaries, prompting federal agencies to prioritize these operations as matters of national security.
3. Geopolitical Safe Havens and Extradition Hurdles
The case of John Erin Binns underscores the persistent challenge of international cybercrime enforcement. As cybercriminals leverage dual citizenship and exploit legal loopholes in non-extradition nations like Turkey, prosecuting decentralized threat actors remains an uphill battle for Western authorities. International cooperation and intelligence-sharing will remain critical tools to pressure foreign jurisdictions and contain fugitive hackers.
As Moucka awaits sentencing in October 2025 and Wagenius faces his day in court in 2026, the legal outcomes serve as a stern warning to the underground cybercrime community: while anonymity and geographic distance offer temporary refuge, global law enforcement partnerships are increasingly capable of dismantling even the most complex digital syndicates.
Lina Irawan 
rifanmuazin 
Neng Nana 