A 26-year-old Canadian man as soon as described as probably the most consequential cybercrime menace actors of 2024 has pleaded responsible to pc fraud and conspiracy to hack and extort greater than 165 organizations that used the cloud supplier Snowflake. Connor Riley Moucka, of Kitchener, Ontario, additionally admitted to stealing name and textual content historical past information of greater than 100 million AT&T clients.
A surveillance photograph of Connor Riley Moucka, a.okay.a. “Judische” and “Waifu,” dated Oct 21, 2024, 9 days earlier than Moucka’s arrest. This picture was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP).
The U.S. Justice Division mentioned between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted knowledge belonging to no less than 165 clients of a U.S.-based software-as-a-service firm.
The hackers focused stolen credentials for Snowflake buyer accounts that didn’t implement multi-factor authentication, and extorted or tried to extort a number of well-known corporations, together with TicketMaster, Lending Tree, Advance Auto Components and Neiman Marcus. Snowflake responded to the information thefts by rising password complexity necessities and implementing multi-factor authentication.
Moucka adopted new nicknames incessantly — typically working a number of identities concurrently — however two of his best-known monikers had been “Judische” and “Waifu.” Judische’s admitted position within the Snowflake knowledge thefts was first documented by KrebsOnSecurity in a September 2024 story concerning the overlap between Western, English-speaking cybercriminals and extremist teams that harass and extort minors into harming themselves or others.
That September 2024 story recognized Judische as a software program engineer from Ontario who has been concerned in quite a few knowledge breaches and voice phishing assaults in opposition to U.S. corporations since no less than 2020. A bit greater than a month later, Canadian authorities arrested Moucka on a provisional warrant from america.
The federal government says Moucka and others used their unauthorized entry to steal billions of delicate buyer information and obtain terabytes of knowledge, “together with people’ non-content name and textual content historical past information, banking and different monetary data, payroll information, Drug Enforcement Administration (DEA) registration numbers, driver’s license numbers, passport numbers, social safety numbers and different personally identifiable data. They then extorted victims by threatening to publish knowledge on-line.”
Moucka additionally threatened and harassed authorities officers and safety researchers who had been serving to to trace him down. The Justice Division mentioned the conspirators remodeled $2.5 million in ransom funds, and that in no less than one occasion, Moucka re-extorted a sufferer with threats of additional disclosure of the sufferer’s stolen knowledge.
“Moucka used the stolen knowledge of a authorities officer and members of a then-former authorities officer’s speedy household on this re-extortion try,” reads a press release from the Justice Division.
One in all Moucka’s admitted co-conspirators is Cameron “Kiberphant0m” Wagenius, a U.S. Military soldier who pleaded responsible in July 2025 to extorting AT&T and Verizon for his or her buyer account knowledge. Lower than a month earlier than Wagenius’s arrest, KrebsOnSecurity printed a deep dive into Kiberphant0m’s numerous Telegram and Discord identities through the years, revealing how the proprietor of the accounts informed others they had been within the Military and stationed in South Korea.
One in all a number of selfies on the Fb web page of Cameron Wagenius.
Kiberphant0m additionally re-extorted victims. Instantly following Moucka’s arrest, Kiberphant0m posted on hacker boards what he claimed had been the AT&T name logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as nicely schematics allegedly stolen from the U.S. Nationwide Safety Company (NSA).
Wagenius is ready to be sentenced on September 3, 2026. The federal government says he faces a most penalty of 20 years in jail for conspiracy to commit wire fraud, a most penalty of 5 years in jail for extortion in relation to pc fraud, and a compulsory two-year sentence consecutive to some other jail time for aggravated id theft.
The third alleged co-conspirator is John Erin Binns, 26, an elusive American man who fled america after being indicted for his admitted position in a 2021 breach at T-Cellular that uncovered the private data of no less than 76 million clients.
Sources near the investigation mentioned Binns, also referred to as “IRDev” and “IntelSecrets,” was till just lately incarcerated in a Turkish jail, however that he has since been launched and has resurfaced on-line. These sources mentioned Binns additionally just lately obtained Turkish citizenship, and underneath Turkish legislation a citizen can’t be extradited to a international nation.
A picture of a passport that Binns shared in an e-mail to KrebsOnSecurity in Feb. 2023.
Moucka pleaded responsible to 4 felony counts, together with pc fraud, wire fraud, aggravated id theft, and conspiracy. He’s slated to be sentenced on Oct. 27 and faces a compulsory minimal penalty of two years in jail on the aggravated id theft depend, in addition to a most penalty of 30 years in jail on the remaining counts. In the end, it will likely be up the federal choose how a lot time Moucka truly serves for his intensive cybercriminal rap sheet.
For an interview with Moucka previous to his arrest and a deeper have a look at Binns, see our authentic report on Moucka’s arrest.
