Engineer sentenced for locking over 3,000 devices on employer network

Daniel Rhyne, a former core infrastructure engineer, remotely accessed his employer's network without authorization using an administrator account between November 8 and November 25, 2023. He scheduled tasks on the domain controller to change the administrator account password, deleted 13 domain admin accounts, and reset passwords for 301 domain user accounts. He also changed passwords for local admin accounts, blocking access to 254 servers and 3,284 workstations, and shut down random servers and workstations over several days. On November 25, he sent a ransom email demanding 20 bitcoins, threatening to shut down 40 servers daily unless paid. Investigations revealed he researched methods to change passwords, delete accounts, and clear Windows logs prior to the attack. This insider attack disrupted critical infrastructure and attempted extortion.

The attack resulted in loss of administrative access to the company's network by deleting domain admin accounts and changing passwords, effectively locking out legitimate administrators and users. Access to thousands of servers and workstations was blocked, and random shutdowns caused operational disruption. The attacker also claimed to have deleted backups, which would have complicated recovery efforts. The incident caused significant operational impact and posed a severe risk to business continuity.

This incident was caused by malicious insider activity using legitimate administrator credentials. Mitigation involves enforcing strict access controls, monitoring for unusual administrative activity, and implementing robust insider threat detection programs. Since this is a past incident with a criminal conviction, no patch or fix applies. Organizations should review and harden privileged access management and incident response procedures to prevent similar insider attacks.