The Fall of "Judische": Inside the Massive Snowflake and AT&T Cloud Extortion Ring

Executive Overview

In a milestone development for international cybersecurity enforcement, 26-year-old Canadian national Connor Riley Moucka has officially pleaded guilty to a sweeping array of federal charges, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. Once identified by threat intelligence analysts as one of the most consequential and destructive cybercrime actors of 2024, Moucka’s conviction marks a critical turning point in the dismantling of an elite syndicate responsible for high-profile data breaches affecting more than 165 major organizations.

Operating under various high-profile monikers—most notably "Judische" and "Waifu"—Moucka orchestrated an aggressive campaign leveraging compromised cloud-storage credentials against prominent enterprise targets, including major software-as-a-service (SaaS) provider Snowflake. Alongside his co-conspirators, Moucka systematically downloaded terabytes of proprietary and personally identifiable information (PII), subsequently extorting major corporations such as TicketMaster, LendingTree, Advance Auto Parts, and Neiman Marcus.

Beyond enterprise targets, the syndicate’s destructive footprint extended into critical telecommunications infrastructure. Moucka and his network admitted to harvesting the sensitive call and text history records of more than 100 million AT&T customers. The fallout from these systemic compromises exposed massive vulnerabilities in cloud posture management, multi-factor authentication (MFA) enforcement, and supply chain security. With Moucka facing up to 30 years in prison—alongside a mandatory minimum sentence for aggravated identity theft—and his co-conspirators facing severe legal reckonings across international jurisdictions, this case stands as a watershed moment for modern threat intelligence, cross-border policing, and corporate accountability.

Detailed Chronology: From Credential Harvesting to Global Arrests

The operational timeline of Moucka and his syndicate highlights a rapid, highly aggressive campaign that spanned from early 2024 through late October of the same year, culminating in international arrests and subsequent guilty pleas.

Early 2024: The Snowflake Incursions Begin

Between February and October 2024, Moucka and his co-conspirators capitalized on harvested credential pairs found circulating on illicit underground forums. Directing their focus toward Snowflake customer accounts that failed to enforce robust multi-factor authentication (MFA), the threat actors breached cloud environments belonging to at least 165 major corporate entities. Rather than deploying traditional ransomware to lock workstations, the group utilized pure extortion tactics: exfiltrating massive volumes of data and threatening public exposure unless extortion demands were met.

September 2024: Investigative Exposure

The operational anonymity of "Judische" began to unravel in September 2024, when cybersecurity investigative journalism brought the actor’s real-world identity into focus. Reports detailed a troubling intersection between Western, English-speaking cybercriminals and digital extremist groups notorious for swatting, harassment, and extorting minors. These investigations pinpointed Judische as an Ontario-based software engineer with a multi-year history of conducting sophisticated voice-phishing (vishing) attacks and data breaches against U.S. corporations dating back to 2020.

October 2024: The Net Closes Around Moucka

As pressure mounted from private security researchers and federal law enforcement agencies, Canadian authorities acted swiftly. On October 21, 2024—just nine days before his eventual apprehension—surveillance operatives captured the final images of Moucka in Ontario. On October 30, 2024, Canadian law enforcement arrested Moucka on a provisional warrant issued by the United States Department of Justice (DOJ).

The Co-Conspirator Network: Wagenius and Binns

Moucka did not operate in a vacuum; his syndicate relied on an interconnected web of digital operatives, military insiders, and international fugitives:

• Cameron “Kiberphant0m” Wagenius: A U.S. Army soldier stationed in South Korea, Wagenius operated as a core member of the extortion network. Digital forensic profiling by investigators revealed Wagenius’s aliases across Telegram and Discord. Wagenius played a pivotal role in targeting telecommunications giants like AT&T and Verizon. In a brazen act of retaliation following Moucka’s arrest, Wagenius posted what he claimed were the AT&T call logs of then-President-elect Donald Trump and then-Vice President Kamala Harris on hacker forums, alongside classified-grade schematics allegedly stolen from the U.S. National Security Agency (NSA). Wagenius pleaded guilty in July 2025 and is scheduled for sentencing on September 3, 2026.
• John Erin Binns (a.k.a. "IRDev", "IntelSecrets"): The third primary co-conspirator, a 26-year-old American citizen, has a long history of cyber incursions, including an indictment for the massive 2021 T-Mobile data breach that exposed records of at least 76 million customers. Fleeing U.S. jurisdiction, Binns ultimately surfaced in Turkey. Sources close to the investigation indicate that Binns recently secured Turkish citizenship. Under Turkish constitutional law, citizens are generally shielded from foreign extradition, complicating international efforts to bring him to trial on U.S. soil.

Supporting Context & Metrics: The Scale of the Devastation

The quantitative and qualitative impact of the Moucka syndicate’s actions places them among the most damaging cybercriminal enterprises in recent history. The breach footprint redefined the parameters of enterprise cloud risk.

• 165+ Enterprise Victims: The primary vector involved unauthorized access to the Snowflake ecosystem, resulting in successful data exfiltration and subsequent extortion attempts against more than 165 high-profile organizations. Victims included household names such as TicketMaster, LendingTree, Advance Auto Parts, and Neiman Marcus.
• 100 Million+ AT&T Customers: The telecommunications breach compromised the non-content call and text history records of virtually the entire AT&T subscriber base, representing an unprecedented violation of consumer privacy.
• Terabytes of Stolen PII: The syndicate stole billions of sensitive customer records. Exfiltrated data classes included banking and financial records, payroll histories, Drug Enforcement Administration (DEA) registration numbers, driver’s licenses, passport numbers, and Social Security numbers (SSNs).
• $2.5 Million+ in Extortion Proceeds: Financial tracking by the DOJ revealed that the conspirators successfully extorted more than $2.5 million in ransom payments from corporate victims.
• Personalized Harassment and Re-Extortion: In a malicious escalation, Moucka and his associates utilized stolen data to harass and re-extort victims, including government officials and security researchers who aided in tracking them down. In one egregious instance highlighted by the DOJ, Moucka leveraged the personal data of a former government officer and their immediate family members to force secondary payouts.

Official Statements and Legal Ramifications

The conclusion of these federal proceedings has drawn sharp commentary from top-tier law enforcement officials, underscoring the severity of the crimes and the determination of global investigative bodies to neutralize cloud-based extortion rings.

The U.S. Justice Department released comprehensive statements detailing the scope of the conspiracy, emphasizing the destructive nature of the defendants’ tactics:

"Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt," the DOJ stated, highlighting the personal malice that often accompanied the group’s financial demands.

Pending Sentences and Statutory Penalties

• Connor Riley Moucka: Having pleaded guilty to four distinct criminal counts—computer fraud, wire fraud, aggravated identity theft, and conspiracy—Moucka is slated for formal sentencing on October 27. He faces a mandatory minimum penalty of two years in prison specifically for the aggravated identity theft charge, which must run consecutively to any other sentence. For the remaining counts, he faces a maximum statutory penalty of up to 30 years in federal prison.
• Cameron Wagenius: Set to face sentencing on September 3, 2026, Wagenius faces a maximum penalty of 20 years in prison for conspiracy to commit wire fraud, an additional maximum penalty of five years for computer fraud-related extortion, and a consecutive mandatory two-year term for aggravated identity theft.

Future Outlook: Lessons for Cloud Security and Enterprise Resilience

The takedown of Connor Riley Moucka and the dismantling of the Snowflake/AT&T extortion syndicate serve as a harsh wake-up call for the cybersecurity industry. The fallout has fundamentally altered how organizations approach cloud security architecture, data governance, and threat actor profiling.

1. Mandatory Multi-Factor Authentication (MFA): The primary vulnerability exploited by Moucka and his crew was the absence of MFA on secondary or legacy Snowflake customer accounts. In response to the breaches, Snowflake radically overhauled its security posture, instituting mandatory password complexity requirements and enforcing MFA across all customer tenants by default. Industry peers are following suit, recognizing that optional security controls are no longer viable in an era of automated credential-stuffing campaigns.
2. The Rise of Pure Extortion Models: The syndicate’s reliance on data exfiltration without traditional ransomware deployment underscores a broader industry trend. Threat actors realize that encrypting endpoints often triggers rapid incident response and law enforcement notification; instead, downloading terabytes of sensitive intellectual property and PII provides immediate leverage for extortion while keeping corporate networks nominally operational.
3. Insider Threats and Radicalized Militants: The involvement of active-duty military personnel like Cameron Wagenius highlights the persistent danger of insider threats intersecting with international cybercrime syndicates. Intelligence agencies must continue to monitor encrypted messaging channels (such as Telegram and Discord) where military and technical personnel are frequently radicalized or recruited by foreign cybercrime elements.
4. Geopolitical Complications in Extradition: The sanctuary found by co-conspirators like John Erin Binns in Turkey—bolstered by newly acquired citizenship—illustrates the enduring hurdle of international borders in cyber law enforcement. As long as nation-states provide safe harbor or refuse extradition for cybercriminals, global policing agencies will need to rely on creative diplomatic pressures, asset freezes, and localized legal maneuvers to disrupt transnational cartels.

Ultimately, while Moucka’s guilty plea represents a major victory for digital justice, it also serves as a permanent reminder of the fragile state of enterprise cloud security and the relentless ingenuity of modern cyber extortionists.