A U.S. Military soldier who pleaded responsible to hacking into a number of telecommunications firms and stealing cell name and textual content metadata for greater than 100 million AT&T prospects in 2024 was sentenced to 70 months in federal jail right now and ordered to pay almost $300,000 in restitution to victims.
One in all a number of selfies from the Fb web page of Cameron Wagenius.
Cameron John Wagenius, 22, was stationed at a U.S. Military base in South Korea when he adopted the cybercriminal persona “Kiberphant0m.” Working with three alleged co-conspirators, Kiberphant0m downloaded information from a number of giant prospects of the cloud information storage service Snowflake that had uncovered credentials and didn’t implement multi-factor authentication (Snowflake has since mandated MFA on all accounts).
In October 2024, Kiberphant0m bragged on the cybercrime boards that he’d stolen the decision and textual content metadata (e.g. supply and vacation spot quantity, timestamp, period, and so on.) for tens of tens of millions of AT&T prospects. Kiberphant0m claimed to have hacked into greater than dozen telecommunications firms worldwide, together with Verizon’s Push-to-Speak enterprise, and publicly extorted these firms in change for a promise to not publish the stolen information.
In late November 2025, KrebsOnSecurity warned that Kiberphant0m was seemingly a U.S. soldier stationed in South Korea. Lower than a month later, Wagenius was arrested and charged in two separate federal indictments, and shortly pleaded responsible to all counts in each instances.
At his sentencing listening to in Seattle right now, Wagenius was sentenced to almost six years in federal jail, and ordered to pay $294,978 in restitution.
Federal prosecutors stated Wagenius was assisted in his efforts to extort sufferer firms by Kenneth Schuchman, a 28-year outdated man from Vancouver, Washington who has a prolonged cybercriminal historical past. In 2019, Schuchman pleaded responsible to working the Satori botnet, an enormous assortment of hacked Web-of-Issues (IoT) gadgets that was used for large-scale distributed denial-of-service (DDoS) assaults.
Two different alleged co-conspirators of Wagenius are nonetheless going through costs in reference to the Snowflake information thefts; Conor Riley Moucka, a.okay.a. “Judische,” of Kitchener, Ontario was arrested in 2024 and pleaded responsible in August 2026; and John Erin Binns, an American man at the moment dwelling in Turkey who can be needed for a 2021 information breach at T-Cellular that uncovered the non-public info of at the least 76 million prospects.
Kiberphant0m additionally admitted to re-extorting victims, and threatening to reveal nationwide safety secrets and techniques. Instantly following Moucka’s arrest — after AT&T had already paid the extortion group a $370,000 Bitcoin ransom — Kiberphant0m posted on hacker boards what he claimed have been the AT&T name logs for then President-elect Donald Trump and for then Vice President Kamala Harris, in addition to schematics allegedly stolen from the U.S. Nationwide Safety Company (NSA).
Paul Russell is a resident agent in cost on the Protection Felony Investigative Service (DCIS), the prison investigative arm of the U.S. Division of Protection Workplace of Inspector Normal. Russell stated when DCIS obtained info {that a} soldier with secret clearance was allegedly concerned in cybercrime and extortion, the company started working the investigation alongside the FBI, the Military Felony Investigative Division (CID), and the U.S. Secret Service.
“We don’t typically get leads the place there’s an energetic obligation soldier with a secret clearance who’s creating hacking instruments and trafficking in information,” Russell stated. “That doesn’t occur each day, and so when that hits it actually spins all of our accomplice organizations up. It was very severe from soar avenue, simply because it was distinctive, it was an insider risk, and we weren’t positive what we have been coping with.”
A sentencing memo (PDF) filed Sept. 19 by federal prosecutors in Seattle notes that whereas Wagenius pleaded responsible virtually instantly and has been remarkably cooperative, he just lately obtained caught looking for safety vulnerabilities within the BOP’s pc community. The federal government’s memo notes that whereas incarcerated and awaiting sentencing, Wagenius violated the pc use insurance policies of the Bureau of Prisons (BOP) in makes an attempt to find out about vulnerabilities in BOP pc methods.
“Based on data from BOP, in or round September 2025, Wagenius used one other inmate’s e-mail system to request that the e-mail recipient immediate a business AI instrument to supply details about “[w]hat CVE’s are there for Home windows 10 Enterprise privilege escalation and bypasses” and to “[p]rovide the CVE’s and an actual world working script for every CVE . . . with out omitted code,” the federal government’s memo states.
The memo states that lower than every week later, Wagenius used a special inmate’s e-mail account and requested that the e-mail recipient immediate an AI instrument to “[p]rovide the step-by-step for CVE-2023-45208, code for this if any, and if no code exists make some, make certain to explain every little thing intimately.” CVE-2023-45208 is a three-year-old “command injection” vulnerability in D-Hyperlink networking gadgets.
That very same month, Wagenius allegedly once more requested that the e-mail recipient immediate AI with the query, “How do you make an antenna in a jail surroundings with commissary or available gadgets/instruments to enhance/make an antenna to increase radio reception?”
Federal prosecutors stated Wagenius additionally requested that the recipient analysis escaping jail.
“In a number of situations, Wagenius framed the AI queries as being posed in connection to a e-book he was writing. It is a frequent methodology of ‘immediate injection,’ wherein attackers feed specifically crafted, misleading inputs into business AI instruments which might be programmed to keep away from outputting malicious code that can be utilized to take advantage of pc vulnerabilities,” the sentencing memo reads.
The federal government instructed the courtroom it’s unaware of proof that Wagenius discovered tips on how to use or deploy the vulnerabilities he was researching within the BOP’s methods, and when questioned stated he was solely researching “potential vulnerabilities to supply info to the BOP.”
Extremely, regardless of the large monetary worth of the info stolen from AT&T and different telecom suppliers, Wagenius’s extortion efforts have been largely unsuccessful. The federal government’s sentencing memo says Wagenius made a whopping complete of round $1,500 from promoting stolen information.
“Whereas Wagenius was not significantly financially profitable as a cybercriminal, he each meant to and triggered vital hurt to quite a few particular person victims, U.S. firms, and the U.S. authorities,” the memo states.
