From Soldier to Cyber-Extortionist: The Rise and Fall of ‘Kiberphant0m’

In a chilling intersection of military service and high-stakes cybercrime, Cameron John Wagenius, a 22-year-old U.S. Army soldier, has been sentenced to 70 months in federal prison. His conviction marks the conclusion of a sprawling investigation into a series of massive data breaches that compromised the private metadata of over 100 million AT&T customers. Operating under the alias "Kiberphant0m" from a military base in South Korea, Wagenius leveraged his access and technical acumen to orchestrate a global campaign of digital extortion that targeted telecommunications giants and even reached into the sensitive vaults of the U.S. national security apparatus.

The sentencing, handed down by a federal court in Seattle, also requires Wagenius to pay nearly $300,000 in restitution—a figure that starkly contrasts with the meager $1,500 he reportedly netted from his illicit activities. The case serves as a landmark example of the "insider threat" phenomenon, highlighting the dangers posed when individuals with security clearances pivot to malicious cyber-activity.

The Chronology of a Digital Crime Wave

The rapid ascent and subsequent downfall of Cameron Wagenius unfolded over a volatile two-year period, beginning with his exploitation of cloud infrastructure and ending in a federal courtroom.

2024: The Snowflake Exploitation

The genesis of the "Kiberphant0m" persona was rooted in the exploitation of Snowflake, a prominent cloud data storage service. Wagenius and his co-conspirators identified large enterprise customers that had failed to enforce multi-factor authentication (MFA) and possessed exposed credentials. By infiltrating these accounts, the group gained unauthorized access to the telecommunications data of millions.

October 2024: Public Extortion

By October 2024, Wagenius began to emerge from the shadows of the dark web. He took to various cybercrime forums to brag about the scope of his theft. His claims included the exfiltration of call and text metadata—specifically timestamps, durations, and source/destination numbers—for tens of millions of AT&T customers. He further alleged that he had successfully breached more than a dozen telecommunications companies worldwide, including Verizon’s "Push-to-Talk" business.

November 2025: The Investigation Heats Up

The investigative work of KrebsOnSecurity identified a strong correlation between the "Kiberphant0m" activity and a U.S. soldier stationed in South Korea. This revelation triggered a multi-agency response, bringing the FBI, the U.S. Secret Service, and the Army Criminal Investigative Division (CID) into a coordinated effort to unmask the perpetrator.

December 2025 – Present: Arrest and Sentencing

Wagenius was arrested in late 2025 and faced two separate federal indictments. His cooperation was immediate, leading to guilty pleas across all counts. However, his legal troubles were compounded by his behavior while in custody, where he was found attempting to research system vulnerabilities and potential prison escape methods.

A Network of Conspirators: The Broader Landscape

Wagenius did not operate in a vacuum. His criminal enterprise was bolstered by a network of seasoned cybercriminals, each with their own history of high-profile digital offenses.

The Role of Kenneth Schuchman

Central to the operation was 28-year-old Kenneth Schuchman of Vancouver, Washington. Schuchman brought "veteran" status to the group; he was previously infamous for his 2019 guilty plea regarding the operation of the Satori botnet. Satori was a massive collection of compromised Internet-of-Things (IoT) devices that had been weaponized to launch devastating distributed denial-of-service (DDoS) attacks against global infrastructure.

Global Co-conspirators

The reach of the Snowflake theft was truly international. Conor Riley Moucka, known by the handle "Judische," operated from Kitchener, Ontario, and pleaded guilty in August 2026. Furthermore, the investigation implicated John Erin Binns, an American citizen residing in Turkey. Binns remains a figure of significant interest to U.S. authorities due to his alleged involvement in the 2021 T-Mobile data breach, which exposed the personal details of at least 76 million individuals.

Official Responses and the "Insider Threat"

The involvement of a soldier with a secret clearance sent shockwaves through the Department of Defense. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS), emphasized the rarity and severity of the situation.

"We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell stated. "That doesn’t happen every day, and so when that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."

The government’s sentencing memo, filed on September 19, painted a portrait of a defendant who was fundamentally dangerous despite his lack of financial success. The prosecutors noted that while Wagenius was cooperative, his persistence in seeking out vulnerabilities—even while incarcerated—demonstrated a persistent disregard for law and order.

Implications: AI, Prison Security, and National Secrets

The most disturbing aspect of the post-arrest phase was Wagenius’s attempt to use Artificial Intelligence to facilitate further illegal activity.

Prompt Injection and AI Abuse

While awaiting sentencing, Wagenius utilized the email accounts of other inmates to manipulate commercial AI tools. Through a technique known as "prompt injection," he attempted to bypass the safety guardrails of these models to obtain actionable information. He requested detailed walkthroughs for "CVE-2023-45208"—a vulnerability in D-Link networking devices—and inquired about privilege escalation for Windows 10. He even sought advice on constructing an antenna within the prison walls to boost radio reception, as well as methods for escaping custody.

The Breach of National Security

The severity of the "Kiberphant0m" case was elevated by the nature of the data stolen. Following the arrest of his associate, Moucka, and after AT&T had already paid a $370,000 Bitcoin ransom, the group engaged in a scorched-earth policy. Wagenius posted what he claimed were AT&T call logs belonging to then-President-elect Donald Trump and then-Vice President Kamala Harris. Additionally, he claimed to possess schematics stolen from the U.S. National Security Agency (NSA).

This reckless disclosure of sensitive information demonstrated that the group was not merely motivated by profit, but by a desire to hold institutions hostage through the threat of public humiliation and national insecurity.

Conclusion: A Cautionary Tale

The case of Cameron Wagenius serves as a stark warning for the modern digital age. Despite his lack of financial gain—having earned only about $1,500 for his massive efforts—the damage he inflicted on individual privacy and corporate stability was immeasurable.

His attempt to use AI as a bridge between his cell and the outside world’s digital infrastructure underscores the evolving nature of prison security in the age of generative technology. As federal authorities close the book on this particular investigation, the case of "Kiberphant0m" will likely be studied for years to come as a quintessential example of how the convergence of high-level military clearance and illicit digital subcultures can create a unique, volatile, and deeply dangerous threat to national security.

The sentencing of Wagenius is not just a punishment for his specific crimes, but a necessary systemic response to an era where the most dangerous threats to our data are often found behind a keyboard, sometimes wearing the uniform of the very institutions they intend to betray.