Daniel Rhyne, 57, from Kansas City, Missouri, received a 32-month prison sentence for his role in locking down over 3,000 devices on his employer's network. The former core infrastructure engineer at a New Jersey-based industrial company pleaded guilty to an extortion plot that ultimately failed. Rhyne was arrested in August 2024 and released following his initial federal court appearance.
Court filings detail how Rhyne gained unauthorized remote access to the company's network using administrator credentials between November 8 and November 25, 2023. He created scheduled tasks on the domain controller that reset the administrator account password to "TheFr0zenCrew!", eliminated 13 domain admin accounts, and modified passwords for 301 domain user accounts to the same string. Additional scheduled tasks changed passwords for two local admin accounts to "PsPasswd", which locked out 254 servers, and altered credentials for two more admin accounts, blocking access to 3,284 workstations. Throughout December 2023, Rhyne also initiated random server and workstation shutdowns across the network.
On November 25, Rhyne distributed an email to colleagues with the subject line "Your Network Has Been Penetrated." In the message, he claimed that server backups had been destroyed to prevent data recovery and demanded 20 bitcoin—valued at approximately $750,000 at that time—or he would shut down 40 random servers each day for the next ten days.
On or about November 25, 2023, at approximately 4:00 p.m. EST, network administrators employed at Victim-1 began receiving password reset notifications for a Victim-1 domain administrator account, as well as hundreds of Victim-1 user accounts. Shortly thereafter, the Victim-1 network administrators discovered that all other Victim-1 domain administrator accounts were deleted, thereby denying domain administrator access to Victim-1's computer networks.
Criminal complaint
Investigation revealed that Rhyne had conducted extensive research to prepare for the attack. On November 22, while developing his extortion scheme, he used a hidden virtual machine to search for techniques on modifying domain user passwords, removing domain accounts, and wiping Windows logs. A week prior, searches on his laptop included queries for "command line to change local administrator password," "command line to remotely change local administrator password," and "how to remotely shutdown a computer usign cmd."
The case adds to a growing pattern of insider threats targeting employers. In March of this year, Cameron Curry, a 27-year-old data analyst contractor in North Carolina, received a two-year prison sentence after conviction for extorting his employer, Brightly Software, a Software-as-a-Service firm formerly operating under the name SchoolDude. Curry's extortion netted $2.5 million.