A 26-year-old Canadian man as soon as described as one of the crucial consequential cybercrime menace actors of 2024 has pleaded responsible to laptop fraud and conspiracy to hack and extort greater than 165 organizations that used the cloud supplier Snowflake<\/strong>. Connor Riley Moucka<\/strong>, of Kitchener, Ontario, additionally admitted to stealing name and textual content historical past information of greater than 100 million AT&T clients.<\/p>\n A surveillance picture of Connor Riley Moucka, a.okay.a. \u201cJudische\u201d and \u201cWaifu,\u201d dated Oct 21, 2024, 9 days earlier than Moucka\u2019s arrest. This picture was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP).<\/p>\n<\/div>\n The U.S. Justice Division stated between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted information belonging to at the least 165 clients of a U.S.-based software-as-a-service firm.<\/p>\n The hackers focused stolen credentials for Snowflake buyer accounts that didn’t implement multi-factor authentication, and extorted or tried to extort a number of well-known corporations, together with TicketMaster, Lending Tree, Advance Auto Components and Neiman Marcus. Snowflake responded to the information thefts by rising password complexity necessities and imposing multi-factor authentication.<\/p>\n Moucka adopted new nicknames regularly \u2014 typically working a number of identities concurrently \u2014 however two of his best-known monikers had been \u201cJudische<\/strong>\u201d and \u201cWaifu<\/strong>.\u201d Judische\u2019s admitted position within the Snowflake information thefts was first documented by KrebsOnSecurity in a September 2024 story<\/a> concerning the overlap between Western, English-speaking cybercriminals and extremist teams that harass and extort minors into harming themselves or others.<\/p>\n That September 2024 story recognized Judische as a software program engineer from Ontario who has been concerned in quite a few information breaches and voice phishing assaults towards U.S. corporations since at the least 2020. A little bit greater than a month later, Canadian authorities arrested Moucka<\/a> on a provisional warrant from america.<\/p>\n The federal government says Moucka and others used their unauthorized entry to steal billions of delicate buyer information and obtain terabytes of knowledge, \u201ctogether with people\u2019 non-content name and textual content historical past information, banking and different monetary data, payroll information, Drug Enforcement Administration (DEA) registration numbers, driver\u2019s license numbers, passport numbers, social safety numbers and different personally identifiable data. They then extorted victims by threatening to publish information on-line.\u201d<\/p>\n Moucka additionally threatened and harassed authorities officers and safety researchers who had been serving to to trace him down. The Justice Division stated the conspirators revamped $2.5 million in ransom funds, and that in at the least one occasion, Moucka re-extorted a sufferer with threats of additional disclosure of the sufferer\u2019s stolen information.<\/p>\n \u201cMoucka used the stolen information of a authorities officer and members of a then-former authorities officer\u2019s speedy household on this re-extortion try,\u201d reads an announcement<\/a> from the Justice Division.<\/p>\n One in all Moucka\u2019s admitted co-conspirators is Cameron \u201cKiberphant0m\u201d Wagenius<\/strong>, a U.S. Military soldier who pleaded responsible in July 2025<\/a> to extorting AT&T and Verizon for his or her buyer account information. Lower than a month earlier than Wagenius\u2019s arrest, KrebsOnSecurity revealed\u00a0a deep dive<\/a>\u00a0into Kiberphant0m\u2019s varied Telegram and Discord identities over time, revealing how the proprietor of the accounts instructed others they had been within the Military and stationed in South Korea.<\/p>\n One in all a number of selfies on the Fb web page of Cameron Wagenius.<\/p>\n<\/div>\n Kiberphant0m additionally re-extorted victims. Instantly following Moucka\u2019s arrest, Kiberphant0m posted on hacker boards what he claimed had been the AT&T name logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as properly schematics allegedly stolen from the U.S. Nationwide Safety Company (NSA).<\/p>\n Wagenius is ready to be sentenced on September 3, 2026. The federal government says he faces a most penalty of 20 years in jail for conspiracy to commit wire fraud, a most penalty of 5 years in jail for extortion in relation to laptop fraud, and a compulsory two-year sentence consecutive to another jail time for aggravated identification theft.<\/p>\n The third alleged co-conspirator is John Erin Binns<\/strong>, 26, an elusive American man who fled america after being indicted for his admitted position in a 2021 breach at T-Cell<\/a> that uncovered the private data of at the least 76 million clients.<\/p>\n Sources near the investigation stated Binns, also referred to as \u201cIRDev<\/strong>\u201d and \u201cIntelSecrets<\/strong>,\u201d was till lately incarcerated in a Turkish jail, however that he has since been launched and has resurfaced on-line. These sources stated Binns additionally lately obtained Turkish citizenship, and underneath Turkish regulation a citizen can’t be extradited to a international nation.<\/p>\n A picture of a passport that Binns shared in an e mail to KrebsOnSecurity in Feb. 2023.<\/p>\n<\/div>\n Moucka pleaded responsible to 4 prison counts, together with laptop fraud, wire fraud, aggravated identification theft, and conspiracy. He’s slated to be sentenced on Oct. 27 and faces a compulsory minimal penalty of two years in jail on the aggravated identification theft depend, in addition to a most penalty of 30 years in jail on the remaining counts. Finally, it is going to be up the federal decide how a lot time Moucka truly serves for his in depth cybercriminal rap sheet.<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2024\/11\/moucka-surveillance.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2024\/12\/camwagenius-selfie.png\")
<\/p>\n![\"\"](\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2024\/07\/binnspassport.png\")
<\/p>\n