A 26-year-old Canadian man once identified as one of the most destructive and consequential cybercrime threat actors of 2024 has officially pleaded guilty to a slate of federal charges, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. Connor Riley Moucka, a resident of Kitchener, Ontario, admitted to orchestrating a massive, multi-faceted hacking and extortion campaign that targeted more than 165 organizations utilizing the cloud service provider Snowflake. Beyond the widespread Snowflake breaches, Moucka also confessed to playing a central role in the massive theft of sensitive call and text history records belonging to more than 100 million AT&T customers.
According to documents released by the U.S. Justice Department, the criminal enterprise unfolded between February and October 2024. During this eight-month window, Moucka and a tightly knit network of co-conspirators systematically exploited stolen login credentials to infiltrate cloud-hosted data reservoirs. The targeted entities were primarily customers of a prominent U.S.-based software-as-a-service provider, namely Snowflake, whose systems became a prime hunting ground for the threat actors.
The mechanics of the Snowflake intrusions relied heavily on an exploitable security blind spot: customer accounts that failed to enforce multi-factor authentication (MFA). By weaponizing valid credentials harvested from prior security incidents or corporate infostealers, the threat actors bypassed traditional perimeter defenses to access deeply sensitive corporate repositories. Once inside, the group systematically exfiltrated terabytes of proprietary data, intellectual property, and personally identifiable information (PII). They then pivoted to high-pressure extortion tactics, threatening to leak the stolen corporate assets on public cybercrime forums unless hefty ransom demands were met.
High-profile corporate giants found themselves directly in the crosshairs of Moucka’s extortion demands, including prominent names such as TicketMaster, Lending Tree, Advance Auto Parts, and Neiman Marcus. The sheer scale and velocity of the Snowflake-related data thefts sent shockwaves through the cloud security industry, prompting Snowflake to institute sweeping structural adjustments. In the wake of the breaches, the cloud provider tightened its security posture by rolling out mandatory multi-factor authentication policies and dramatically increasing password complexity requirements for all customer accounts to prevent similar credential-stuffing attacks.
Throughout his operations, Moucka demonstrated a high degree of operational security paranoia, adopting a revolving door of digital monikers and frequently operating multiple online aliases simultaneously. Among his most notorious and enduring handles were "Judische" and "Waifu." The dark nexus connecting Judische to the Snowflake data heists was first brought to light by KrebsOnSecurity in a September 2024 investigative report. That initial exposé detailed the troubling overlap between English-speaking Western cybercriminal networks and extremist groups that routinely harass, swat, and extort minors into committing acts of self-harm or violence.
The September 2024 report pinpointed Judische as a software-trained engineer operating out of Ontario, Canada, who had sustained a multi-year cybercriminal career characterized by large-scale corporate data breaches and aggressive voice-phishing campaigns directed against U.S. entities dating back to at least 2020. The net closed rapidly around the Canadian national a little over a month after the publication of that report, when Canadian law enforcement agencies apprehended Moucka under the authority of a provisional arrest warrant issued by the United States.
Federal prosecutors detailed the staggering volume and sensitive nature of the information harvested by Moucka and his accomplices. The stolen cache included billions of sensitive customer records and terabytes of data encompassing non-content call and text history logs, comprehensive banking and financial documentation, internal corporate payroll records, official Drug Enforcement Administration (DEA) registration numbers, driver’s license cards, passport credentials, Social Security numbers, and a myriad of other critical PII.
Beyond standard corporate extortion schemes, the investigation revealed a pattern of severe harassment and intimidation directed at government officials, corporate executives, and independent security researchers who actively assisted law enforcement in tracking down the perpetrators. The Justice Department reported that the criminal conspiracy successfully extorted upwards of $2.5 million in ransom payments from panicked victims. In particularly brazen instances of malice, Moucka engaged in secondary extortion tactics, re-extorting corporate victims by threatening to release even more damaging iterations of their proprietary data if further demands were ignored.
In one particularly egregious illustration of these tactics highlighted by the Justice Department, Moucka leveraged the stolen personal records of a government official and members of that official’s immediate family to fuel a re-extortion campaign.
Federal investigators soon unmasked several key individuals operating alongside Moucka within the decentralized cybercrime ring. Among the primary co-conspirators identified is Cameron “Kiberphant0m” Wagenius, a serving U.S. Army soldier. Wagenius officially pleaded guilty in July 2025 to federal charges stemming from his role in the extortion scheme targeting major telecommunication infrastructure providers, specifically AT&T and Verizon, for their extensive customer account logs.
Weeks prior to the public disclosure of Wagenius’s arrest, KrebsOnSecurity published an exhaustive deep dive analyzing Kiberphant0m’s historical footprints across various Telegram and Discord channels. Those investigations mapped out how the individual behind the alias had openly communicated details regarding his active-duty military status and his geographical deployment to South Korea.
Wagenius’s criminal activities also extended into high-profile secondary extortion attempts. Immediately following Moucka’s high-profile arrest by Canadian authorities, Kiberphant0m flooded underground cybercrime forums with what he purported to be authentic AT&T call and text logs belonging to prominent political figures, including then President-elect Donald Trump and then Vice President Kamala Harris. Alongside these political logs, the soldier allegedly disseminated sensitive engineering schematics purportedly stolen from the U.S. National Security Agency (NSA).
Wagenius is currently scheduled to appear in federal court for sentencing on September 3, 2026. According to federal sentencing guidelines, he faces a maximum statutory penalty of 20 years in federal prison for conspiracy to commit wire fraud, an additional maximum penalty of five years for extortion linked to computer fraud, and a mandatory, consecutive two-year prison sentence specifically designated for aggravated identity theft.
A third key figure in the sprawling international conspiracy is John Erin Binns, a 26-year-old American fugitive who fled the United States after a federal grand jury indicted him for his admitted central role in a massive 2021 cyberattack against T-Mobile. That prior breach compromised the sensitive personal data of at least 76 million current and former customers.
Intelligence sources close to the unfolding federal investigations indicated that Binns—who frequently operated under digital monikers such as "IRDev" and "IntelSecrets"—had spent a period incarcerated within a Turkish prison facility. However, sources report that Binns has since regained his freedom and quietly resurfaced across digital platforms. Furthermore, reports indicate that Binns successfully acquired official Turkish citizenship. Under strict Turkish constitutional and legal frameworks, sovereign nations generally bar the extradition of their own citizens to foreign jurisdictions, complicating any prospective efforts by U.S. prosecutors to bring him to American soil for trial.
With his guilty plea finalized, Connor Riley Moucka now awaits his formal sentencing hearing, which has been slated for October 27. He faces a mandatory minimum prison sentence of two years specifically tied to the aggravated identity theft count, alongside a maximum potential sentence of 30 years in federal custody across the remaining counts of computer fraud, wire fraud, and conspiracy. Ultimately, the exact duration of the prison term Moucka will serve for his extensive and disruptive cybercriminal enterprise will rest within the discretion of the presiding federal judge.
