securityweek.comarticleInsider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison
SecurityWeek reports that Daniel Rhyne, a core infrastructure engineer, was sentenced to 32 months for sabotaging and extorting his employer, an industrial firm in New Jersey. In November 2023 he planted scheduled tasks on the domain controller that deleted 13 domain admin accounts and reset passwords on 301 domain users, 254 servers and 3,284 workstations, mostly to 'TheFr0zenCrew!'. He then emailed a 20 bitcoin (about $750,000) ransom demand. Internal log correlation with physical access records, plus FBI work, traced the activity to his home IP address.
TL;DR Insider engineer who used scheduled tasks on a domain controller to lock out his employer and demand 20 BTC got 32 months, caught by log and IP correlation.
Organisations named here
- DOJ
- FBI
- TheFr0zenCrew!
Technologies named here
- Victim firm's domain controller
- Scheduled tasks on the domain controller
- Local administrator accounts on 254 servers
- Local administrator accounts on 3,284 workstations
- FBI investigation
- Bitcoin
- Active Directory
Techniques named here
- Forensic attribution
Threat actors named here
- 'TheFr0zenCrew!'
- Daniel Rhyne
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup