A 26-year-old Canadian man who was widely regarded by cybersecurity researchers and law enforcement as one of the most consequential cybercrime threat actors of 2024 has officially pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and conspiracy. Connor Riley Moucka, a resident of Kitchener, Ontario, admitted before a federal court to his central role in a massive, coordinated hacking and extortion campaign that targeted more than 165 major organizations utilizing cloud provider Snowflake. Beyond the corporate cloud breaches, Moucka also confessed to stealing sensitive call and text history records belonging to more than 100 million AT&T customers during a sweeping spree of digital theft.
According to the U.S. Justice Department, the expansive criminal enterprise unfolded between February and October 2024. During this period, Moucka and a cadre of co-conspirators systematically leveraged stolen login credentials to access, exfiltrate, and hold for ransom vast quantities of cloud-hosted corporate data. The primary targets of the threat actors were customer accounts belonging to organizations using the U.S.-based software-as-a-service cloud environment that failed to mandate multi-factor authentication. By exploiting these security oversights, the conspirators successfully breached numerous high-profile corporate giants and household-name brands, including TicketMaster, Lending Tree, Advance Auto Parts, and Neiman Marcus. In the wake of the catastrophic data breaches, Snowflake was forced to respond aggressively by tightening security protocols, significantly increasing password complexity requirements, and strictly enforcing multi-factor authentication across its platform.
Throughout his operations, Moucka continually adapted his digital footprint, frequently adopting new nicknames and occasionally operating multiple online identities concurrently to evade detection. However, two of his most prominent and heavily tracked monikers within the cybercrime underground were "Judische" and "Waifu." The connection between the persona "Judische" and the massive Snowflake data thefts was first brought to light by investigative journalist Brian Krebs in a September 2024 report. That investigation explored the dark nexus connecting Western, English-speaking cybercriminals with malicious extremist groups that routinely harass, swat, and extort minors into committing acts of self-harm or violence against others.
The September 2024 report identified "Judische" as an Ontario-based software engineer who had spent years participating in numerous high-profile data breaches and targeted voice phishing campaigns directed against U.S. corporations since at least 2020. Barely a month after those investigative details emerged in the public domain, Canadian law enforcement authorities apprehended Moucka acting on a provisional arrest warrant issued by the United States.
Federal prosecutors detailed the staggering scale of the data pilfered by Moucka and his accomplices, noting that the group utilized unauthorized access to steal billions of sensitive customer records and download terabytes of proprietary information. The stolen troves encompassed a wide array of highly confidential data, including individuals’ non-content call and text history records, comprehensive banking and financial information, corporate payroll records, Drug Enforcement Administration (DEA) registration numbers, driver’s license numbers, passport numbers, social security numbers, and various other forms of personally identifiable information. Armed with these massive caches of stolen material, the conspirators ruthlessly extorted their corporate victims by threatening to leak the compromised data publicly online if ransom demands were not met.
The operation was marked not only by financial extortion but also by targeted intimidation. Court documents reveal that Moucka actively threatened and harassed government officials and security researchers who were actively working to track down his digital trail and dismantle his infrastructure. According to the Justice Department, the conspirators successfully raked in more than $2.5 million in ransom payments from their corporate targets. In a particularly egregious display of corporate and personal betrayal, Moucka engaged in a practice known as re-extortion, where a victim who had already paid a ransom was targeted a second time with fresh threats that their stolen data would be leaked regardless.
In at least one documented instance of re-extortion, Moucka utilized the sensitive personal data of a government officer and the immediate family members of a former government officer to force compliance and extract further leverage.
As federal investigators unraveled the conspiracy, they identified several key accomplices working alongside Moucka. One of his admitted co-conspirators is Cameron "Kiberphant0m" Wagenius, a U.S. Army soldier who formally pleaded guilty in July 2025 to federal charges related to the hacking and extortion scheme involving major telecommunications companies, specifically targeting AT&T and Verizon for customer account data. Just weeks prior to Wagenius’s arrest, investigative reporting published a deep dive into Kiberphant0m’s extensive history across various Telegram and Discord channels. Those digital trails revealed how the owner of the accounts frequently boasted to online associates about being an active-duty soldier stationed in South Korea.
Wagenius also engaged in the malicious tactic of re-extorting victims. In the immediate aftermath of Moucka’s arrest, Wagenius brazenly posted files on underground hacker forums claiming to contain the AT&T call logs of then-President-elect Donald Trump and then-Vice President Kamala Harris, alongside engineering schematics allegedly stolen from the U.S. National Security Agency (NSA). Wagenius is scheduled to face sentencing on September 3, 2026. The government has noted that he faces a maximum statutory penalty of 20 years in prison for conspiracy to commit wire fraud, an additional maximum penalty of five years in prison for extortion connected to computer fraud, and a mandatory two-year prison sentence that must run consecutively to any other prison time handed down for aggravated identity theft.
A third individual implicated as a co-conspirator in the broader criminal network is John Erin Binns, a 26-year-old American citizen who fled the United States after being indicted for his admitted role in a massive 2021 data breach at T-Mobile that compromised the personal information of at least 76 million customers. Sources close to the ongoing investigation have indicated that Binns—who operated under online aliases such as "IRDev" and "IntelSecrets"—was incarcerated in a Turkish prison until recently. According to those sources, Binns has since been released, has resurfaced online, and successfully obtained Turkish citizenship. Under Turkish constitutional law, citizens cannot be extradited to foreign jurisdictions, complicating efforts by American authorities to bring him to trial.
Following his guilty plea to four criminal counts encompassing computer fraud, wire fraud, aggravated identity theft, and conspiracy, Moucka is scheduled to appear in court for his sentencing hearing on October 27. He faces a mandatory minimum sentence of two years in federal prison specifically for the aggravated identity theft charge, alongside a maximum possible penalty of up to 30 years in prison for the remaining counts. Ultimately, the exact amount of time Moucka will spend behind bars for his extensive and disruptive cybercriminal career will be determined by the presiding federal judge.
