Engineer sentenced to 32 months for ransomware-style attack on former employer

Engineer Sentenced for Network Attack

Daniel Rhyne, a 57-year-old former core infrastructure engineer, was sentenced to 32 months in prison. He pleaded guilty to his role in an extortion plot against his former employer, an industrial company headquartered in New Jersey. Rhyne was arrested in August 2024.

Unauthorized Access and Network Disruption

Between November 8 and November 25, Rhyne remotely accessed the company's network without authorization using an administrator account. He scheduled tasks on the domain controller to change the administrator account password to "TheFr0zenCrew!", delete 13 domain admin accounts, and change passwords for 301 domain user accounts to "TheFr0zenCrew!".

Rhyne also changed passwords for two local admin accounts to "PsPasswd", blocking access to 254 servers, and changed passwords for two more admin accounts, blocking access to an additional 3,284 workstations. He shut down random servers and workstations over several days in December 2023.

Ransom Demand and Investigation

On November 25, Rhyne sent a ransom email titled "Your Network Has Been Penetrated" to coworkers. In the email, he claimed server backups were deleted and threatened to shut down 40 random servers daily for ten days unless the company paid a 20 bitcoin ransom, valued at approximately $750,000 at the time.

Investigators found that Rhyne searched for information on changing domain user passwords, deleting domain accounts, clearing Windows logs, and remotely shutting down computers while planning the attack.