Former Engineer Pleads Guilty to Extortion Plot That Locked 254 Servers
Summary
Former infrastructure engineer Daniel Rhyne pleaded guilty to an extortion plot involving unauthorized access, account deletions and password resets that affected 254 servers and 3,284 workstations at his employer.
Key points
- Rhyne remotely accessed his former employer’s network using an administrator account between November 9 and November 25, 2023.
- Scheduled tasks deleted domain admin accounts and reset passwords for 13 domain administrators and 301 domain users.
- Password changes affected 3,284 workstations and 254 servers; other scheduled tasks were set to shut down systems.
- Rhyne demanded 20 bitcoin and threatened to shut down 40 servers daily if the ransom was not paid.
- Investigators found a hidden virtual machine and web searches related to clearing Windows logs and changing or deleting accounts.
- Rhyne pleaded guilty and faces a maximum sentence of 15 years in prison.
Article Details
- Victim Organization
- Victim-1 (unnamed industrial company)
- Victim Domain
- Unknown
- Incident Type
- Insider unauthorized network access and attempted extortion involving account deletion, password resets, and scheduled system shutdowns
- Incident Date
- 2023-11-09
- Affected Records
- 13 domain administrator accounts and 301 domain user accounts had their passwords reset; two local administrator accounts were associated with 3,284 workstations and two others with 254 servers. No exposed or stolen records were reported.
- Operational Impact
- Domain administrator accounts were deleted, denying administrators access to the network. Password changes affected accounts associated with 3,284 workstations and 254 servers. Some scheduled tasks shut down random systems in December 2023; the source does not specify the duration or broader extent of disruption.
- Ransom Or Extortion
- Daniel Rhyne demanded 20 bitcoin, reportedly worth about $750,000 at the time, and threatened to shut down 40 random servers daily for ten days unless paid. The source does not report that a ransom was paid. His email claimed server backups had been deleted, but the article does not confirm that they were.
- Claim Status
- confirmed
MITRE ATT&CK
T1053.005 · Scheduled TaskScheduled tasks on the Windows domain controller were used to delete accounts, change passwords, and shut down systems.T1078 · Valid AccountsRhyne remotely accessed the network using an administrator account.T1529 · System Shutdown/RebootScheduled tasks were used to shut down random servers and workstations.T1531 · Account Access RemovalDeleted domain administrator accounts and reset account passwords, denying network administrators access.