A Canadian named Connor Moucka dropped out of high school and moved in with his grandfather. An American, John Binns, who resides in Turkey, was anxious about being monitored by the FBI and CIA. Meanwhile, Cameron Wagenius, a US soldier, reportedly searched online for options to defect to Russia.
According to the filing records, This unexpected group now faces serious charges for a large-scale hacking operation that resulted in millions of dollars in ransom demands and a significant amount of stolen phone records. Officials from the FBI have raised concerns that the theft could compromise sensitive communications between agents and their informants.
Both Moucka, 25, and Binns, 25, who is currently imprisoned in Turkey, are accused of breaching the customers of Snowflake Inc. and attempting to extort ransom payments in exchange for deleting the stolen information.
Companies such as AT&T Inc., Live Nation Entertainment Inc., and Advance Auto Parts Inc. revealed that they were impacted by these attacks in June and July.
It remains uncertain whether Moucka or Binns have entered a plea at this point.
Wagenius, a 21-year-old who was stationed in Texas, admitted to attempting to sell stolen data from AT&T. According to a court filing from February 26, prosecutors indicated that Wagenius also contacted an email he believed belonged to a foreign intelligence agency, seeking to sell the stolen information.
The lawyers representing the trio did not respond to numerous requests for comments.
On Friday, authorities in Canada scheduled an extradition hearing for Moucka on March 21. The US has requested his extradition to face charges linked to hacks involving at least ten Snowflake customers.
Details about how Moucka, Binns, and Wagenius connected and allegedly participated in related cybercrimes have surfaced in court documents, social media histories, and interviews with individuals who followed their activities online.
In the online world, Moucka used the alias Waifu, while Wagenius identified himself as KiberPhant0m, and Binns went by Irdev, as noted by US prosecutors.
Their online identities were involved in conspiracy theories and expressed distrust towards the US government, based on messages reviewed by Bloomberg.
An arrest warrant alleges that Moucka, under the name Waifu, posted on Discord about sending sodium nitrite pills to Black people in Michigan and Ohio in January 2024.
Moments later, he commented, “I think I’d make a really good serial killer,” according to the warrant. He discussed mass shootings, as reported by Canadian authorities.
Additionally, Waifu bragged about connections to Atomwaffen Division, a neo-Nazi group, based on messages seen by Bloomberg.
He shared disturbing content about rape and torture in group chats on Telegram that were frequented by young hackers.
In real life, Moucka appeared to be different; he had trouble making friends and mostly stayed in his grandfather’s bungalow in Ontario.
According to Przeklasa, Moucka’s grandfather, “He’d work for 30 hours and then fall asleep. He didn’t know what day it was.” Moucka did not finish high school, and Przeklasa, 75, believed he was working as a freelance software developer.
Moucka spent countless hours in front of two computer monitors in his bedroom, keeping a window open to cool his noisy processors during the cold winter months.
His mother and stepfather reside in the US, where he occasionally visited as a teenager. During the Covid-19 pandemic, he was encouraged to take virtual classes, which Przeklasa believes contributed to the extreme views outlined in his arrest warrant, as he spent all his time online.
In the late 2010s, Moucka and Binns, using their online names Waifu and Irdev, met while gaming, according to interviews with people who tracked them for years.
They are thought to be part of a loose online network known as the Com, according to Allison Nixon, a cybersecurity expert who has monitored its members for years.
The Com mostly consists of young English-speaking men involved in financially motivated crimes, like hacking social media accounts for sale on the black market and stealing from cryptocurrency wallets.
Online, Waifu and Irdev compared their hacking activities to acts of sexual violence and sometimes threatened other Com members, Nixon noted, mentioning that she was threatened by Waifu.
In 2024, Moucka reconnected with Binns to allegedly hack and extort AT&T after stealing six months’ worth of mobile phone customer call and text logs, according to public chat logs and a source familiar with the defendants who wished to remain anonymous.
The breach alarmed FBI officials, who feared that agents’ phone records were among the stolen data, potentially endangering confidential informants.
In early October, US prosecutors urged Canadian authorities to arrest Moucka due to his violent online threats.
FBI Issues and Challenges
After Moucka’s arrest, KiberPhant0m attempted to sell the AT&T data on a criminal forum. KiberPhant0m, linked to Wagenius, had met Waifu online a few months earlier, according to the source.
By that time, Binns was already in custody in Turkey on hacking and privacy violation charges, though the specifics remain unclear. It’s unknown if Binns has pleaded to the Turkish charges.
Binns, who was born in Virginia, grew up in McLean, near the CIA headquarters. His father passed away when he was very young, and his mother is a Turkish citizen.
He had long believed that the CIA and FBI were watching him, as noted in court documents reviewed by Bloomberg.
Binns attempted to sue both agencies in 2020, claiming that the FBI had been surveilling him since he moved to Izmir, Turkey, with his mother in 2018.
He also alleged that the CIA shot “psychotronic lasers” into his bedroom and tried to kill him in 2019. Neither the FBI nor CIA responded to requests for comments, and his lawsuit was dismissed.
In 2022, Binns was charged in the US for hacking T-Mobile’s systems, where he installed malware to steal data from 76.6 million customers—after admitting to the hack in a 2021 interview with the Wall Street Journal. This breach ultimately cost T-Mobile $350 million to settle a class-action lawsuit.
As Binns faced increasing legal problems, Irdev and Waifu continued their collaboration, according to US prosecutors. The duo aimed to hack into telecom companies to find out who was investigating them, according to three sources familiar with the situation who remained anonymous for safety reasons.
Waifu’s Telegram account often mocked Irdev’s fears about being tracked by the FBI and CIA, based on messages reviewed by Bloomberg.
However, a person who knew Moucka, who asked to remain unnamed, stated that he was fascinated by Russia, frequently discussing it and changing his name to Alexander Antonin Moucka from Connor Riley Moucka to sound more Eastern European.
Wagenius also showed interest in Russia. According to US prosecutors, while on active duty at Fort Cavazos in November last year, he searched online for ways to defect to Russia. At the same time, he was accused by US prosecutors of trying to extort AT&T with the call records stolen by Moucka and Binns.
While Binns awaited trial in Izmir, he was granted Turkish citizenship, meaning he will not be extradited to the US, according to a senior Turkish official who spoke on the condition of anonymity.
Back in Canada, Przeklasa said police were ready for a dangerous situation when they arrived to arrest Moucka on October 30.
“They said they were about five minutes away from breaking down the door and gassing the place to get to him,” Przeklasa recounted, after police confronted him from a church parking lot. “I gave them my keys and told them there’s a doorbell.”
Moucka simply opened the door. Authorities did not find any sodium nitrite pills or weapons that Waifu had bragged about online, his grandfather said.
Przeklasa did not attend Moucka’s court hearings. After Moucka’s arrest, police took the computer where Przeklasa had saved photos and videos of his late wife Sheila. His request to have them returned was denied. “He fooled me,” Przeklasa said about Moucka.
Posts You May Like