Former U.S. Army Soldier Sentenced to Nearly Six Years in Federal Prison for Massive Telecom Extortion and Data Heist

SEATTLE — A federal judge in Seattle sentenced a 22-year-old former U.S. Army soldier to 70 months in federal prison today for orchestrating a series of sophisticated cyberattacks and extortions targeting major telecommunications giants, including AT&T. The defendant, who operated under the chilling online moniker “Kiberphant0m,” was also ordered to pay nearly $300,000 in victim restitution.

Cameron John Wagenius, stationed at a U.S. military base in South Korea at the time of the offenses, pleaded guilty to multiple felony counts following a high-profile international investigation. Operating alongside an international syndicate of seasoned cybercriminals, Wagenius targeted cloud data storage providers and multinational telecom networks, downloading sensitive metadata belonging to more than 100 million AT&T customers. Despite the staggering scale of the data breach—which exposed call and text logs for tens of millions of Americans, including high-profile political figures—investigators revealed that Wagenius netted a paltry $1,500 from his illicit enterprises.

The case has sent shockwaves through the Department of Defense, exposing critical insider-threat vulnerabilities and highlighting the growing intersection of military clearance misuse, cloud security gaps, and malicious artificial intelligence utilization.

Chronology of an Insider Threat: From Barracks to Cybercrime Forums

The saga of "Kiberphant0m" unfolded rapidly across late 2024, combining classic cyber intrusions with brazen public extortion tactics.

• Early-to-Mid 2024: While on active duty in South Korea and holding a secret security clearance, Wagenius exploited credentials exposed through cloud data storage service Snowflake. Because several Snowflake customers failed to enforce mandatory multi-factor authentication (MFA)—a systemic oversight that Snowflake has since rectified—Wagenius and his co-conspirators successfully exfiltrated vast repositories of enterprise data.
• October 2024: Operating under his cybercriminal persona, Wagenius took to underground hacking forums to brag about compromising more than a dozen telecommunications companies worldwide. He claimed responsibility for stealing call and text metadata—including source numbers, destination numbers, timestamps, and call durations—for tens of millions of AT&T customers, alongside systems belonging to Verizon’s Push-to-Talk division. He launched public extortion campaigns, threatening to leak the data unless corporations paid steep ransoms in cryptocurrency.
• Late November 2024: Security journalist Brian Krebs published investigative findings warning that the elusive "Kiberphant0m" was likely an active-duty U.S. soldier stationed on the Korean peninsula.
• December 2024: Federal law enforcement agents arrested Wagenius. He was promptly hit with two separate federal indictments, to which he quickly pleaded guilty, initiating full cooperation with federal prosecutors.
• September 2025 (Incarcerated Activity): While awaiting sentencing in a federal Bureau of Prisons (BOP) facility, Wagenius was caught attempting to bypass prison computer restrictions. Utilizing other inmates’ email accounts, he fed deceptive prompts into commercial AI tools to harvest Windows privilege escalation vulnerabilities and research prison escape methods.
• Today: A federal judge in Seattle handed down a 70-month prison sentence and mandated $294,978 in victim restitution.

The Syndicate and Supporting Data: Scale of the Breaches

While Wagenius served as a primary technical disruptor and insider threat, federal prosecutors outlined a tightly knit, multi-national cybercrime network working in tandem with the former soldier.

Key Co-Conspirators

1. Kenneth Schuchman (28, Vancouver, Washington): Prosecutors identified Schuchman as a primary assistant in the extortion schemes. Schuchman is no stranger to federal law enforcement; in 2019, he pleaded guilty to operating the notorious Satori botnet, a massive collection of compromised Internet-of-Things (IoT) devices used to launch crippling distributed denial-of-service (DDoS) attacks.
2. Conor Riley Moucka (a.k.a. “Judische,” Kitchener, Ontario): Arrested in Canada in 2024, Moucka played a central role in handling communications and ransom demands. He formally pleaded guilty in August 2026.
3. John Erin Binns: An American expatriate currently residing in Turkey, Binns remains wanted by U.S. authorities. In addition to the Snowflake-related extortions, Binns is wanted for his suspected involvement in the massive 2021 T-Mobile data breach that exposed the personal records of at least 76 million customers.

The AT&T Ransom and National Security Fallout

The syndicate’s operations turned increasingly desperate and erratic following law enforcement interventions. Following the arrest of Conor Moucka—and despite AT&T having already paid the extortion group a staggering $370,000 Bitcoin ransom—a vengeful Kiberphant0m retaliated online.

In a final, high-stakes breach of operational security, Wagenius posted what he claimed were the AT&T call logs of then President-elect Donald Trump and then Vice President Kamala Harris to hacker forums. Furthermore, he threatened to disclose classified national security schematics allegedly stolen from the U.S. National Security Agency (NSA).

Despite these massive data volumes, government sentencing memos revealed a stark economic irony: for all the international chaos, corporate extortion attempts, and potential national security compromises, Wagenius personally profited a mere $1,500 from selling the stolen data.

Official Responses: A Unique and Terrifying Insider Threat

The intersection of active-duty military service, active security clearances, and sophisticated cyberattacks prompted an unprecedented joint response from the nation’s premier investigative agencies.

Paul Russell, resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the Department of Defense Office of Inspector General—emphasized the alarming nature of the case. Russell spearheaded the investigation alongside the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service.

“We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell stated. “That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.”

Federal prosecutors echoed these sentiments in their court filings. While acknowledging Wagenius’s swift guilty plea and cooperative posture, the government underscored the profound severity of his actions.

“While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government,” prosecutors noted in the September sentencing memo.

Implications: AI Prompt Injection Behind Bars and Future Security

Perhaps one of the most alarming revelations from the sentencing memo is Wagenius’s relentless, calculated drive to exploit vulnerabilities even while locked behind bars. Awaiting sentencing inside a federal Bureau of Prisons facility, Wagenius demonstrated that incarceration had done little to curb his technical ambitions or his appetite for illicit network access.

Weaponizing AI via "Prompt Injection"

According to BOP records cited by prosecutors, Wagenius covertly utilized other inmates’ email accounts in September 2025 to query commercial artificial intelligence tools. Because modern AI models feature safety guardrails programmed to reject requests for malicious code, Wagenius deployed "prompt injection" techniques—framing his queries within the context of a fictional book he claimed to be writing.

Through this deception, Wagenius successfully solicited:

• Specific Common Vulnerabilities and Exposures (CVEs) and working scripts for Windows 10 Enterprise privilege escalation.
• Step-by-step exploit code for CVE-2023-45208, a critical command injection vulnerability affecting D-Link networking devices.
• Instructions on how to jury-rig makeshift antennas using prison commissary items to intercept and extend local radio and wireless signals.
• Research materials and methods pertaining to prison escapes.

While federal prosecutors stated there was no evidence Wagenius successfully deployed these exploits against BOP computer systems—and noted his claims that he was merely researching vulnerabilities "to provide information to the BOP"—the incident illustrates the acute danger posed by unmitigated technical minds operating within correctional environments.

Industry-Wide Aftermath

The case of Cameron Wagenius leaves a lasting imprint on cybersecurity practices across both the private and public sectors:

1. Mandatory MFA: The Snowflake breaches exposed the fatal flaw of optional security measures, forcing cloud-storage providers across the globe to mandate multi-factor authentication for all enterprise and individual accounts.
2. Insider Threat Detection: Defense agencies are re-evaluating how active-duty personnel with secret clearances are monitored for digital moonlighting, underground forum activity, and the creation of unapproved hacking toolsets.
3. AI Safety and Guardrails: The ease with which Wagenius bypassed commercial AI safety filters using pseudo-literary framing serves as a stark warning to AI developers regarding the necessity of advanced prompt-injection defenses.

As Wagenius begins serving his 70-month federal sentence, federal agencies continue their pursuit of remaining co-conspirators, aiming to dismantle the remnants of the global syndicate that briefly brought major telecommunications infrastructure to its knees.