U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

1. Executive summary

Cameron John Wagenius, a 22-year-old U.S. Army soldier who operated as "Kiberphant0m," was sentenced in Seattle on 2026-09-25 to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking telecommunications providers and stealing mobile call and text metadata belonging to more than 100 million AT&T customers in 2024. The intrusion path ran through Snowflake customer accounts that had exposed credentials and no enforced multi-factor authentication, not through a flaw in AT&T or Verizon infrastructure. The only CVE named in the case is CVE-2023-45208 (CVSS 8.8 HIGH, CWE-77 command injection in D-Link networking devices, EPSS 1%, not in CISA KEV), which Wagenius researched from prison and which is not the vector for the telecom thefts. The direct risk to EMEA financial services is third-party data-platform exposure and the downstream fraud value of call and text metadata, not this actor's tradecraft, which was opportunistic and, by the government's own account, earned him roughly $1,500.

2. Regulatory framing

No DORA incident-reporting article (Art. 17, 18, 19) is engaged by this item for an EMEA client: the incident is a 2024 U.S. telecom breach, not an incident at the client. NIS2 Art. 23 and UK NIS 2018 are likewise not triggered unless a client suffered its own reportable incident from the same Snowflake exposure.

3. Technical analysis & attack chain

This is a breach and extortion case, not a vulnerability campaign. The confirmed sequence:

1. Wagenius, stationed at a U.S. Army base in South Korea, adopted the persona "Kiberphant0m" and worked with three alleged co-conspirators.
2. The group downloaded data from several large customers of the cloud data storage service Snowflake. The source states the entry condition plainly: those accounts had exposed credentials and did not enforce multi-factor authentication. Snowflake has since mandated MFA on all accounts.
3. In October 2024, Kiberphant0m claimed on cybercrime forums to have stolen call and text metadata (source and destination number, timestamp, duration) for tens of millions of AT&T customers. He claimed intrusions into more than a dozen telecommunications companies worldwide, including Verizon's Push-to-Talk business.
4. He publicly extorted the victim companies, promising not to publish the stolen data in exchange for payment.
5. AT&T paid the extortion group a $370,000 Bitcoin ransom. Immediately after co-conspirator Conor Riley Moucka's arrest, Kiberphant0m posted what he claimed were AT&T call logs for then President-elect Donald Trump and then Vice President Kamala Harris, plus schematics allegedly stolen from the U.S. National Security Agency.
6. Wagenius admitted to re-extorting victims and to threatening disclosure of national security secrets.

The government's sentencing memo states Wagenius made around $1,500 total from selling stolen data, despite the scale of the theft. The extortion effort was largely unsuccessful in financial terms.

The CVE in this item is not the intrusion vector. CVE-2023-45208 is a command injection flaw (CWE-77) in D-Link networking devices, CVSS 8.8 HIGH, EPSS 1%, not in CISA KEV. Wagenius researched it from inside the Bureau of Prisons in September 2025, using another inmate's email account to ask a third party to prompt a commercial AI tool for "the step by step for CVE-2023-45208, code for this if any, and if no code exists make some." The government told the court it is unaware of evidence he deployed any researched vulnerability against BOP systems. There is no indication CVE-2023-45208 was used against AT&T, Verizon, or any telecom victim. Treat it as context on the actor's post-arrest behaviour, not as a live threat to client estates.

Insider and AI-abuse angle. Wagenius held a secret clearance while committing the crimes, which is why DCIS, the FBI, Army CID, and the U.S. Secret Service ran the investigation jointly. The sentencing memo describes his prison research as a form of prompt injection: he framed AI queries as being for a book he was writing to elicit exploit code. The government found no evidence he succeeded in weaponising the results.

Attribution caveat. The four named individuals (Kiberphant0m / Cameron John Wagenius, Kenneth Schuchman, Conor Riley Moucka, John Erin Binns) have no MITRE ATT&CK profile in the verified reference data. Attribution of the Snowflake thefts to this group rests on the KrebsOnSecurity reporting and the U.S. sentencing documents; it is single-sourced at the level of this advisory and should be treated as unconfirmed for enforcement purposes. Schuchman's 2019 Satori botnet guilty plea and Binns's wanted status over a 2021 T-Mobile breach are reported background, not established links to the 2024 telecom thefts beyond the source's statement that they are alleged co-conspirators.

4. Mitigation & containment

P1 (within 24 hours)

• Audit every Snowflake tenant and equivalent cloud data platform account for MFA enforcement. The source states Snowflake now mandates MFA on all accounts; confirm the mandate is active on your tenants and that no service or legacy accounts are exempt.
• Hunt for exposed credentials tied to data-platform accounts in public paste sites, credential-stuffing corpora, and stealer logs. Rotate any credential found, and rotate any credential that has not been rotated since before the provider's MFA mandate.
• Confirm whether your organisation holds AT&T, Verizon, or other telecom call and text metadata as a customer or processor. If so, treat it as compromised-adjacent and review access logs for the 2024 window.

P2 (within 72 hours)

• Review DORA Art. 30 key contracts with cloud data platform providers for clauses requiring MFA, credential exposure monitoring, and notification when the provider changes a security control.
• Restrict data-platform access to named identities with MFA; remove shared or service accounts that cannot satisfy MFA.
• Where call and text metadata is processed, apply data minimisation and confirm retention limits, since the fraud value of this data persists after the breach.

P3 (within 7 days)

• Add detection for anomalous bulk export from data-platform tenants (see §6).
• If you operate D-Link networking devices, confirm firmware is current against CVE-2023-45208. This is precautionary and unrelated to the telecom thefts, but the CVE is public and the actor researched it.

5. Indicators of compromise

No atomic indicators of compromise (hashes, domains, IPs, file paths, registry keys) are present in the source material. The source describes the intrusion at the level of method and victim, not artefacts.

Behavioural indicators:

6. Detection

The source contains no file artefacts, command lines, mutexes, or registry keys from the threat itself. The only named technical string is a CVE identifier, which is not a threat artefact and must not be used as a detection string. There is no usable material for a YARA rule.

A Sigma rule is possible for the behavioural pattern the source describes: anomalous bulk export from a cloud data platform. This is a generic behaviour, not a signature of this actor, and will require tuning.

title: Anomalous Bulk Export from Cloud Data Platform Tenant
id: 8f3c1a20-7b4e-4d9a-9c11-2e6f0a5b7d31
status: experimental
description: Detects large-volume export or download activity from a cloud data platform tenant, consistent with the Snowflake data theft pattern described in Advisory AT-2026-09-26-1090. Generic behaviour; tune thresholds to environment.
author: Adverse Trace
date: 2026-09-26
references:

  - https://krebsonsecurity.com/2026/09/u-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions/
logsource:
  product: snowflake
  service: account_usage
detection:
  selection:
    QUERY_TYPE:

      - 'SELECT'
      - 'COPY INTO'
    BYTES_SCANNED|gte: 1000000000
  condition: selection
falsepositives:

  - Legitimate analytics and ETL jobs
  - Scheduled reporting
level: low

CVE assessment

1 referenced CVE

7. Sources

• KrebsOnSecurity, "U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions," https://krebsonsecurity.com/2026/09/u-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions/, 2026-09-25.

8. Adverse Trace position

Adverse Trace assesses the direct risk to EMEA financial services clients from this item as low, with one exception: any client holding telecom call and text metadata, or running a cloud data platform tenant with weak credential and MFA controls, faces a real exposure that this case illustrates. The severity of CVE-2023-45208 is CVSS 8.8 HIGH with EPSS 1% and no CISA KEV listing, and it is not the vector for the telecom thefts, so it does not change our assessment. Attribution of the Snowflake thefts to this group is single-sourced in the material available to us and the named individuals have no MITRE ATT&CK profile, so we treat it as unconfirmed. We will monitor for further Snowflake-credential exposure affecting financial sector tenants and will issue a follow-up if the co-conspirator cases (Moucka, Binns) produce technical detail that changes the exposure picture.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.