Cameron John Wagenius, a 22-year-old U.S. Army soldier, has been sentenced to 70 months in federal prison following his role in a sophisticated global cyber-extortion campaign that compromised the sensitive metadata of over 100 million AT&T customers. Operating under the alias "Kiberphant0m" while stationed at a military installation in South Korea, Wagenius orchestrated a series of breaches that targeted major telecommunications providers, ultimately leading to a high-profile federal prosecution that highlighted the vulnerabilities of cloud-based infrastructure and the persistent threat of insider actors. In addition to his prison term, a federal judge in Seattle ordered Wagenius to pay $294,978 in restitution to his victims.
The Anatomy of the Breach
The investigation into Wagenius revealed a calculated exploitation of modern cloud security oversights. Wagenius, alongside a network of co-conspirators, identified and accessed large-scale databases hosted on the cloud storage platform Snowflake. The attackers specifically targeted accounts that failed to implement multi-factor authentication (MFA), a security standard that has since become mandatory across the platform following the incident.
By leveraging exposed credentials, Wagenius gained unauthorized access to the call and text metadata of millions of AT&T customers. This data included critical information such as source and destination phone numbers, timestamps, and the duration of communications—details that, while not containing the content of the messages themselves, provide a high-resolution map of individual social and professional networks. The scale of the breach was unprecedented, effectively exposing the communication habits of a significant portion of the U.S. population.
A Chronology of Cyber-Extortion
The timeline of the Kiberphant0m operation spans roughly two years of escalating criminal activity. By October 2024, the scope of the theft became public as the persona began bragging on dark-web forums about the volume of data stolen. During this period, Wagenius claimed responsibility for infiltrating over a dozen telecommunications companies worldwide, including Verizon’s specialized Push-to-Talk infrastructure.
The extortion attempts followed a predictable, high-pressure pattern. Wagenius and his associates contacted victimized companies, threatening to leak the stolen data to the public unless a ransom was paid in cryptocurrency. Despite the high volume of stolen data, the financial gain for the perpetrators was remarkably low. Federal sentencing documents indicate that Wagenius earned only approximately $1,500 from his efforts, illustrating a vast disparity between the immense harm caused to corporations and the meager illicit profits generated by the scheme.
The investigation intensified in November 2024 when KrebsOnSecurity published an analysis identifying the likely location of the perpetrator as a U.S. soldier in South Korea. This breakthrough allowed the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service to converge on the suspect. Wagenius was arrested shortly thereafter and faced two separate federal indictments, to which he pleaded guilty.
Collaborators and Co-conspirators
Wagenius did not act in isolation. Prosecutors identified Kenneth Schuchman, a 28-year-old from Vancouver, Washington, as a key facilitator. Schuchman brought significant technical expertise to the operation, drawing on a criminal history that included his 2019 conviction for operating the Satori botnet, a massive infrastructure of compromised Internet-of-Things (IoT) devices used to conduct distributed denial-of-service (DDoS) attacks.
Other figures in the network remain subject to ongoing legal proceedings. Conor Riley Moucka, known by the alias "Judische," was arrested in Canada and pleaded guilty in August 2026. Furthermore, John Erin Binns, an American citizen currently residing in Turkey, remains a target of federal interest; Binns is also a person of interest in the massive 2021 T-Mobile data breach that affected at least 76 million customers.
The National Security Dimension
The severity of the case was amplified by the perpetrator’s status as an active-duty soldier with a secret security clearance. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS), described the incident as a "unique" insider threat. "We don’t often get leads where there’s an active duty soldier with a secret clearance who is creating hacking tools and trafficking in data," Russell noted. "It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
The danger escalated when the group, having already received a $370,000 Bitcoin ransom from AT&T, pivoted toward national security threats. Following the arrest of his associate Moucka, Wagenius posted alleged NSA schematics and the call logs of high-level government officials, including then President-elect Donald Trump and then Vice President Kamala Harris, on public hacker forums. This move transformed the case from a corporate extortion matter into a direct concern for national security agencies.
In-Custody Misconduct and AI Exploitation
The government’s sentencing memorandum revealed that even while in custody and awaiting his sentence, Wagenius continued to pose a security risk. In September 2025, investigators discovered that he was using the emails of fellow inmates to conduct "prompt injection" attacks against commercial artificial intelligence tools.
Wagenius attempted to bypass the safety protocols of these AI models to generate information on Windows 10 privilege escalation, command injection vulnerabilities in D-Link hardware, and even methods for constructing radio antennas within a prison environment. When confronted, he claimed he was researching these vulnerabilities to assist the Bureau of Prisons (BOP), a justification the court found unconvincing given his history of deceptive behavior.
Broader Implications for Cybersecurity
The sentencing of Wagenius serves as a stark case study in the risks of the modern digital landscape. First, the reliance on cloud storage providers by major telecommunications firms introduces a single point of failure that, if compromised, can result in the catastrophic loss of data for millions of users. The shift toward mandatory multi-factor authentication (MFA) is a direct response to this vulnerability, though industry experts argue that security must go beyond simple credential management.
Second, the case highlights the challenge of "insider threats" within government agencies. When an individual with a security clearance utilizes their access—or the skills learned through military training—to engage in cyber-criminality, the conventional perimeter defenses of the Department of Defense become less effective.
Finally, the incident underscores the emergence of generative AI as a tool for bad actors. The ease with which Wagenius attempted to elicit code for exploits from commercial AI models demonstrates that as these tools become more powerful, they also become a force multiplier for those attempting to bypass system security. While the government found no evidence that Wagenius successfully deployed these specific exploits against the BOP, the attempt itself reflects a persistent, high-level intent to subvert digital infrastructure that remains a major concern for federal law enforcement.
As the legal proceedings against the remaining co-conspirators continue, the case of Kiberphant0m remains a landmark example of how individual actors, through a combination of technical persistence and exploitation of systemic security gaps, can inflict profound damage on both the private sector and the national security apparatus.
