Cybersecurity
Engineer sentenced for locking 3,000 devices
Daniel Rhyne, a former core infrastructure engineer from Kansas City, received a 32-month sentence after pleading guilty to disabling devices and accounts on his employer’s network and demanding bitcoin.
- Daniel Rhyne, 57, was sentenced to 32 months in prison after pleading guilty to his role in a failed extortion plot against the New Jersey industrial company that employed him.
- Court documents said he remotely accessed the company network without authorisation between 8 November and 25 November 2023 using an administrator account.
- Prosecutors said he changed administrator passwords, deleted 13 domain admin accounts and altered 301 domain user passwords to "TheFr0zenCrew!", then changed two local admin accounts to "PsPasswd" and blocked access to 254 servers and another 3,284 workstations.
- The complaint said he sent coworkers a ransom email on 25 November demanding 20 bitcoin, about $750,000 at the time, and investigators said he had searched for password and shutdown commands beforehand.
Daniel Rhyne, 57, of Kansas City, Missouri, received a 32-month prison sentence after pleading guilty to his part in a failed extortion scheme. He had been arrested in August 2024 and released after his first appearance in federal court.
Court documents said he used an administrator account to reach the employer’s network without permission between 8 November and 25 November 2023. Investigators said he then set scheduled tasks on a domain controller that changed the administrator password to "TheFr0zenCrew!", deleted 13 domain admin accounts and changed 301 domain user passwords to the same phrase.
The filing said he also set tasks that changed the passwords for two local admin accounts to "PsPasswd", which blocked access to 254 servers. It said he later changed two more admin accounts, cutting off another 3,284 workstations, and shut down random servers and workstations over several days in December 2023.
On 25 November, he emailed coworkers a ransom message headed "Your Network Has Been Penetrated". The message said backups had been deleted and threatened to shut down 40 random servers a day for ten days unless the company paid 20 bitcoin, which was worth about $750,000 then.
Investigators said a hidden virtual machine and his laptop showed web searches on password changes, account deletion and Windows log clearing. The complaint also said he had searched earlier for ways to change and disable local administrator access and to shut down a computer remotely from the command line.
Named in this story
People
- Daniel Rhyne
- The former core infrastructure engineer who was sentenced after pleading guilty.
Places
- Kansas City, Missouri
- His home city.
- New Jersey
- The state where the employer company was headquartered.
How the source tells it
The article was written in a factual court-report style, with mild alarm coming from the scale of the lockout and the ransom threat.
- alarm the scale of the account lockouts and the ransom demand create a threatening register
- urgency the threat to keep shutting down servers over successive days adds pressure to the account