U.S. Soldier Sentenced to 70 Months for Telecom Extortion Schemes

U.S. Soldier Sentenced to 70 Months for Telecom Extortion Schemes Cameron John Wagenius, a 22-year-old active-duty U.S. Army soldier who operated under the hacker alias 'Kiberphant0m', has been sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking and attempting to extort AT&T, Verizon, and other telecommunications companies. Wagenius stole mobile call and text metadata belonging to more than 100 million AT&T customers using compromised Snowflake credentials lacking multi-factor authentication. Despite demanding ransoms and posting stolen NSA schematics and claimed call logs for political figures, Wagenius earned only around $1,500 from selling data. The crimes involved three alleged co-conspirators: Kenneth Schuchman, Conor Riley Moucka, and John Erin Binns. While detained and awaiting sentencing, Wagenius used other inmates' email accounts to prompt commercial AI tools for exploit scripts, prison antenna designs, and escape research. Snowflake Breaches and Extortion Operations While stationed at an Army base in South Korea with a secret clearance, Wagenius operated as 'Kiberphant0m' to access data from Snowflake cloud customers with exposed credentials and no multi-factor authentication. In October 2024, he bragged on cybercrime forums about stealing call and text metadata for over 100 million AT&T customers and hacking more than a dozen telecom companies, including Verizon's Push-to-Talk service. After AT&T paid a $370,000 Bitcoin ransom to the group, Wagenius re-extorted victims and threatened national security secrets, posting alleged NSA schematics and call logs for Donald Trump and Kamala Harris. Despite causing substantial harm, prosecutors stated Wagenius netted roughly $1,500 himself. Investigation and Accomplices A joint investigation by the Defense Criminal Investigative Service, the FBI, Army CID, and the Secret Service treated the case as a serious insider threat once Wagenius's military status and clearance surfaced. Prosecutors linked Wagenius to Kenneth Schuchman, who previously operated the Satori IoT botnet, as well as two other defendants facing charges in the Snowflake data thefts: Conor Riley Moucka, who pleaded guilty in August 2026, and John Erin Binns, an American fugitive residing in Turkey who is also wanted for a 2021 T-Mobile data breach. In-Custody AI Exploitation Attempts A federal sentencing memorandum revealed that while awaiting sentencing in September 2025, Wagenius repeatedly violated Bureau of Prisons computer use policies by using other inmates' email accounts to query commercial AI models. Framing prompts under the pretext of writing a book, he requested working exploit code for Windows 10 privilege escalation and a known D-Link vulnerability (CVE-2023-45208), as well as directions on constructing antennas from prison items and prison escape techniques. Although Wagenius claimed he was auditing vulnerabilities to help the BOP, prosecutors found no evidence he successfully deployed the exploits inside the facility.

美陆军士兵因入侵并勒索AT&T和Verizon获刑70个月 22岁的美国陆军现役士兵卡梅隆·约翰·瓦格纽斯因黑客攻击多家电信运营商、窃取超1亿AT&T客户通话和短信元数据并实施勒索，在西雅图联邦法院被判处70个月监禁，并被勒令偿还近30万美元赔偿金。 瓦格纽斯在驻韩美军服役期间化名“Kiberphant0m”，利用凭据泄露且未启用多因素认证的Snowflake云存储账户窃取数据并公开勒索。 瓦格纽斯持有秘密安全许可，其同谋包括Satori僵尸网络操纵者肯尼斯·舒赫曼、加拿大人莫卡以及涉T-Mobile数据泄露的宾斯。 尽管涉及逾亿用户的敏感元数据，瓦格纽斯在网络犯罪中仅获利约1500美元，但对受害公司和政府造成了重大危害。 在押候判期间，瓦格纽斯通过借用狱友邮箱向商业AI工具进行提示词注入，试图探寻监狱管理局网络漏洞及越狱方法。 黑客攻击与电信巨头勒索内情 瓦格纽斯在驻韩美军基地服役期间化名“Kiberphant0m”，针对包括AT&T与Verizon在内的十余家全球电信企业发动黑客攻击，获取了超1亿AT&T客户的通话和短信元数据。在AT&T支付370000美元比特币赎金后，瓦格纽斯仍实施二次勒索，并在黑客论坛上发布声称属于唐纳德·特朗普、卡玛拉·哈里斯的通话记录以及涉嫌窃自美国国家安全局的图纸。由国防刑事调查局（DCIS）、FBI等联合展开的调查指出，此类具有机密许可的现役军人成为内部威胁的案件极为罕见。 复杂的犯罪团伙与有限的个人收益 检方指出瓦格纽斯得到了曾运营Satori僵尸网络的肯尼斯·舒赫曼的协助，同案中涉嫌参与Snowflake数据窃取的莫卡已认罪，另一名嫌疑人宾斯目前在土耳其受到通缉。尽管盗取的数据具有极高的潜在财务价值，但政府量刑备忘录显示，瓦格纽斯通过出售被盗数据仅实际获利约1500美元，未能实现显著的个人经济收益，但其行为依然构成了极其恶劣的危害后果。 羁押期间试图利用AI挖掘系统漏洞 西雅图检方递交的备忘录透露，瓦格纽斯在被捕认罪并等待宣判期间，违反了联邦监狱管理局（BOP）的电脑使用规定。他使用其他囚犯的电子邮件账户，指示收件人向商业AI工具提问，以“写书”为掩护实施提示词注入，试图获取Windows权限提升CVE脚本、D-Link网络设备漏洞代码，甚至询问如何利用日用品制作天线及越狱方法。瓦格纽斯辩称此举仅为协助监狱排查系统隐患，检方亦未发现其成功部署利用漏洞的证据。

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million **AT&T** customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims. **Cameron John Wagenius**, 22, was stationed at a U.S. Army base in South Korea when he adopted the cybercriminal persona “**Kiberphant0m**.” Working with three alleged co-conspirators, Kiberphant0m downloaded data from several large customers of the cloud data storage service **Snowflake** that had exposed credentials and did not enforce multi-factor authentication (Snowflake has since mandated MFA on all accounts). In October 2024, Kiberphant0m bragged on the cybercrime forums that he’d stolen the call and text metadata (e.g. source and destination number, timestamp, duration, etc.) for tens of millions of AT&T customers. Kiberphant0m claimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish the stolen data. In late November 2025, KrebsOnSecurity warned that Kiberphant0m [was likely a U.S. soldier stationed in South Korea](https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/). Less than a month later, Wagenius was [arrested](https://krebsonsecurity.com/2024/12/u-s-army-soldier-arrested-in-att-verizon-extortions/) and charged in two separate federal indictments, and soon pleaded guilty to all counts in both cases. At his sentencing hearing in Seattle today, Wagenius was sentenced to nearly six years in federal prison, and ordered to pay $294,978 in restitution. Federal prosecutors said Wagenius was assisted in his efforts to extort victim companies by **Kenneth Schuchman**, a 28-year old man from Vancouver, Washington who has a lengthy cybercriminal history. In 2019, Schuchman [pleaded guilty to operating the **Satori** botnet](https://krebsonsecurity.com/2019/09/satori-iot-botnet-operator-pleads-guilty/), a vast collection of hacked Internet-of-Things (IoT) devices that was used for large-scale distributed denial-of-service (DDoS) attacks. Two other alleged co-conspirators of Wagenius are still facing charges in connection with the Snowflake data thefts; **Conor Riley Moucka**, a.k.a. “Judische,” of Kitchener, Ontario was arrested in 2024 and [pleaded guilty in August 2026](https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/); and **John Erin Binns**, an American man currently living in Turkey who is also wanted for [a 2021 data breach at T-Mobile](https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/) that exposed the personal information of at least 76 million customers. Kiberphant0m also admitted to re-extorting victims, and threatening to disclose national security secrets. Immediately following Moucka’s arrest — after AT&T had already paid the extortion group a $370,000 Bitcoin ransom — Kiberphant0m posted on hacker forums what he claimed were the AT&T call logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as well as schematics allegedly stolen from the U.S. National Security Agency (NSA). **Paul Russell** is a resident agent in charge at the **Defense Criminal Investigative Service** (DCIS), the criminal investigative arm of the U.S. Department of Defense Office of Inspector General. Russell said when DCIS received information that a soldier with secret clearance was allegedly involved in cybercrime and extortion, the agency began working the investigation alongside the FBI, the Army Criminal Investigative Division (CID), and the U.S. Secret Service. “We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell said. “That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.” A [sentencing memo](https://krebsonsecurity.com/wp-content/uploads/2026/09/wagenius-sentencingmemo.pdf) (PDF) filed Sept. 19 by federal prosecutors in Seattle notes that while Wagenius pleaded guilty almost immediately and has been remarkably cooperative, he recently got caught trying to find security vulnerabilities in the BOP’s computer network. The government’s memo notes that while incarcerated and awaiting sentencing, Wagenius violated the computer use policies of the **Bureau of Prisons** (BOP) in attempts to learn about vulnerabilities in BOP computer systems. “According to records from BOP, in or around September 2025, Wagenius used another inmate’s email system to request that the email recipient prompt a commercial AI tool to provide information about “\[w\]hat CVE’s are there for Windows 10 Enterprise privilege escalation and bypasses” and to “\[p\]rovide the CVE’s and a real world working script for each CVE . . . without omitted code,” the government’s memo states. The memo states that less than a week later, Wagenius used a different inmate’s email account and requested that the email recipient prompt an AI tool to “\[p\]rovide the step by step for [CVE-2023-45208](https://nvd.nist.gov/vuln/detail/cve-2023-45208), code for this if any, and if no code exists make some, make sure to describe everything in detail.” CVE-2023-45208 is a three-year-old “command injection” vulnerability in D-Link networking devices. That same month, Wagenius allegedly again requested that the email recipient prompt AI with the question, “How do you make an antenna in a prison environment with commissary or readily available items/tools to improve/make an antenna to extend radio reception?” Federal prosecutors said Wagenius also requested that the recipient research escaping prison. “In several instances, Wagenius framed the AI queries as being posed in connection to a book he was writing. This is a common method of ‘prompt injection,’ in which attackers feed specially crafted, deceptive inputs into commercial AI tools that are programmed to avoid outputting malicious code that can be used to exploit computer vulnerabilities,” the sentencing memo reads. The government told the court it is unaware of evidence that Wagenius figured out how to use or deploy the vulnerabilities he was researching in the BOP’s systems, and when questioned said he was only researching “potential vulnerabilities to provide information to the BOP.” Incredibly, despite the enormous financial value of the data stolen from AT&T and other telecom providers, Wagenius’s extortion efforts were largely unsuccessful. The government’s sentencing memo says Wagenius made a whopping total of around $1,500 from selling stolen data. “While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government,” the memo states.