From Soldier to Cyber-Extortionist: The Rise and Fall of ‘Kiberphant0m’

In a landmark case that underscores the evolving threat of the “insider” in the age of cloud-based data storage, a 22-year-old U.S. Army soldier has been sentenced to 70 months in federal prison. Cameron John Wagenius, who operated under the menacing digital alias “Kiberphant0m,” was handed the sentence in a Seattle courtroom today, marking the conclusion of a high-stakes investigation into a massive telecommunications data breach that compromised the privacy of over 100 million AT&T customers.

Beyond the prison term, Judge Richard Jones ordered Wagenius to pay $294,978 in restitution to his victims. The sentencing follows a guilty plea from the former soldier, who was stationed in South Korea at the height of his criminal activities. The case is particularly notable not only for the scale of the data theft—which included sensitive call and text metadata—but for the chilling revelation that an active-duty service member with secret security clearance was actively trafficking in stolen intelligence and attempting to extort major U.S. corporations and government entities.

A Chronology of Chaos: The Kiberphant0m Campaign

The path to the courtroom began in 2024, when Wagenius, leveraging his position within the U.S. Army, pivoted toward a life of cybercrime. Operating from his base in South Korea, he identified a critical weakness in the digital infrastructure of several global enterprises: the reliance on cloud data storage provider Snowflake.

The Snowflake Vulnerability

Wagenius and his co-conspirators targeted Snowflake clients who had failed to secure their accounts with multi-factor authentication (MFA). By exploiting exposed credentials, the group exfiltrated vast repositories of data. While Snowflake has since mandated MFA for all users, the damage was already done.

The Extortion Phase

By October 2024, the scope of the operation became public. Wagenius began bragging on dark-web forums about his acquisition of call and text metadata—including source numbers, destination numbers, timestamps, and call durations—for tens of millions of AT&T customers. His ambition was not limited to one carrier; he claimed to have breached over a dozen telecommunications firms worldwide, including Verizon’s specialized “Push-to-Talk” business. He employed a “shame-and-extort” model, threatening to leak sensitive data unless companies paid him in cryptocurrency.

Detection and Arrest

The turning point came in November 2025, when investigative reporting by KrebsOnSecurity identified a link between the “Kiberphant0m” persona and a U.S. soldier stationed in South Korea. The investigative trail tightened rapidly. Less than a month later, federal authorities apprehended Wagenius. He faced two separate federal indictments, and in an effort to mitigate his sentence, he pleaded guilty to all counts.

Supporting Data: The Anatomy of the Breach

The sheer volume of data involved in the Kiberphant0m campaign makes it one of the most significant breaches of telecommunications privacy in recent history. The metadata stolen provides a blueprint of the social and professional connections of 100 million people.

The Co-conspirators

Wagenius did not act alone. His network included:

• Kenneth Schuchman: A 28-year-old from Vancouver, Washington, with a storied criminal history. Schuchman previously pleaded guilty in 2019 to operating the “Satori” botnet, which hijacked IoT devices to execute massive DDoS attacks.
• Conor Riley Moucka (a.k.a. “Judische”): Based in Kitchener, Ontario, Moucka was a key player in the Snowflake thefts. He entered a guilty plea in August 2026.
• John Erin Binns: An American expatriate currently residing in Turkey. Binns remains a person of interest in multiple major breaches, including the 2021 T-Mobile hack that exposed the personal data of 76 million individuals.

The “National Security” Escalation

The case took a turn for the surreal following the arrest of co-conspirator Moucka. Despite AT&T having already paid a $370,000 ransom in Bitcoin, the extortionists betrayed the agreement. Kiberphant0m retaliated by leaking what he claimed were call logs for high-profile political figures, including then President-elect Donald Trump and Vice President Kamala Harris. Furthermore, he claimed to possess classified schematics stolen from the U.S. National Security Agency (NSA).

Official Responses: An Insider Threat Reality Check

The involvement of a soldier with secret clearance sent shockwaves through the Department of Defense. Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS), expressed the gravity of the situation.

“We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell remarked. “That doesn’t happen every day. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.”

The investigation was a massive inter-agency effort, involving the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service. The collaboration highlights a shift in federal strategy: recognizing that cyber-threats are no longer limited to external hackers, but can originate from within the very institutions tasked with protecting national security.

The Prison Paradox: Attempting to Hack from Within

Perhaps the most alarming aspect of the case was Wagenius’s behavior while awaiting sentencing. Despite being in custody, he exhibited a compulsive need to probe system vulnerabilities. According to a sentencing memo filed by federal prosecutors on September 19, Wagenius engaged in “prompt injection” attacks against commercial AI tools while using the Bureau of Prisons (BOP) computer network.

Exploiting AI

Using the email accounts of other inmates, Wagenius requested that recipients feed specific, deceptive prompts into AI models. He sought:

• Details on Windows 10 Enterprise privilege escalation vulnerabilities (CVEs).
• Working scripts for command injection vulnerabilities in D-Link networking hardware.
• Instructions for constructing radio antennas from commissary items.
• Methods for escaping prison facilities.

Prosecutors noted that while Wagenius claimed these queries were for a book he was writing, the technique—known as prompt injection—is a common method for bypassing the safety guardrails programmed into commercial AI tools. There is currently no evidence that he successfully deployed these exploits within the prison system, but the attempt alone demonstrates a high level of recidivism and technical obsession.

Implications: A Lesson for Corporate and National Security

The story of Kiberphant0m serves as a sobering lesson for both the private sector and the military-industrial complex.

Financial Realities vs. Real-World Harm

While the scale of the breach was massive, the financial windfall for the perpetrators was remarkably low. Prosecutors noted that Wagenius earned only about $1,500 from the data he stole—a pittance compared to the millions in damages and the $370,000 ransom paid by AT&T. This discrepancy underscores a dangerous reality: cyber-extortionists are often driven more by the thrill of the “hack” and the desire to cause chaos than by purely rational economic gain.

The MFA Imperative

The success of the Snowflake-based attacks highlights that even the most sophisticated corporations are vulnerable if they do not enforce basic security hygiene. The industry-wide shift toward mandatory multi-factor authentication is a direct response to breaches like this one.

The Insider Threat Challenge

For the U.S. military, the case represents a failure of personnel oversight. The fact that an individual with secret clearance could operate an international cybercrime ring from a base in South Korea suggests significant gaps in monitoring the digital behavior of service members.

As the digital battlefield continues to merge with physical security, the case of Cameron Wagenius serves as a prototype for future investigations. He will spend the next five-and-a-half years in federal prison, but the ripples of his digital sabotage will continue to be felt by the millions of Americans whose data remains exposed in the dark corners of the internet. The lesson for the future is clear: when it comes to cyber-insurgency, the enemy may already be inside the wire.