A former core infrastructure engineer at an industrial company headquartered in New Jersey was sentenced to 32 months in prison for locking thousands of devices on his employer's network in a ransomware-style attack.
57-year-old Daniel Rhyne from Kansas City, Missouri, pleaded guilty to his role in a failed extortion plot targeting the New Jersey company that employed him after being arrested in August 2024 and released after his initial appearance in federal court.
According to court documents, he remotely accessed the company's network without authorization using an administrator account between November 8 and November 25 and scheduled tasks on the domain controller that changed the password of the administrator account to "TheFr0zenCrew!", deleted 13 domain admin accounts, and changed the passwords for 301 domain user accounts to "TheFr0zenCrew!".
Rhyne also added scheduled tasks that changed the password for two local admin accounts to "PsPasswd" (blocking access to 254 servers), changed the password for two more admin accounts (blocking access to an additional 3,284 workstations), and shut down random servers and workstations on the company's network over several days in December 2023.
On November 25, Rhyne sent coworkers a ransom email titled "Your Network Has Been Penetrated," in which he said that server backups had also been deleted to make data recovery impossible and threatened to shut down 40 random servers daily over the next ten days unless the company paid a 20 bitcoin ransom (roughly $750,000 at the time).